Quick answers
- Is CVE-2026-18614 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18614 being exploited in the wild.
- How severe is CVE-2026-18614?
- Critical severity, with a CVSS score of 9.8, published 3 August 2026.
- Which products and versions are affected?
- GL.iNet GL-MT3000 up to 4.4.5.
- Is there a fix for CVE-2026-18614?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18614 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-18614?
- Check whether you run GL.iNet GL-MT3000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a command injection flaw in the s2s.so native plugin, specifically in the s2s.enable_echo_server function accessible via /cgi-bin/glc. The root cause is insufficient input validation on the port parameter, allowing an attacker to inject shell metacharacters and execute arbitrary system commands. The attack vector is remote and requires no authentication. An attacker can manipulate the port argument to execute commands with the privileges of the web server process, potentially achieving remote code execution and full device compromise. The vendor confirmed the vulnerability; patch status is not explicitly stated in the advisory.
Affected products
- GL-iNet GL-MT3000 up to 4.4.5
Timeline
- 2026-08-03: disclosed