CVE-2026-18686

GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection

State: Published
Severity: 9.3 Critical
Published: Aug 4, 2026
Updated: Aug 4, 2026
Reserved: Aug 3, 2026

Description

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	10.0 High	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
GL-MT3000GL.iNet	4.4.0Affected 4.4.1Affected 4.4.2Affected 4.4.3Affected 4.4.4Affected 4.4.5Affected

References

VDB-385612 | GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injectionvdb-entrytechnical-description
VDB-385612 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-18686 | CVE Analysis and Reportthird-party-advisory
Submit #856139 | GL.iNet MT3000 4.4.5 Command Injectionthird-party-advisory
https://github.com/coconut652-7/IOT_Vul_Public/tree/main/Glinet/MT3000/nas-web/ADD_USER_ADD_SHAREexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.