A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5.

CVE-2026-18686 is an unauthenticated command injection in the nas-web.add_user function within /cgi-bin/glc on the GL.iNet GL-MT3000 (Beryl AX), a pocket-sized Wi-Fi 6 travel router retailing for ~$90. Affected firmware versions span 4.4.0 through 4.4.5. An attacker with network access to the device's management interface can inject shell commands via the NAS user-creation RPC endpoint, achieving root-level code execution with no credentials required. Public exploit code exists on GitHub.

The vendor's CVSS 9.8 is *technically* correct in a vacuum — unauthenticated network-accessible RCE checks every box on the CVSS calculator. But CVSS doesn't ask "is this device actually deployed in your enterprise?" The GL-MT3000 is a consumer travel router. It does not appear in enterprise asset inventories, is not a managed endpoint, and is not a network edge appliance in any meaningful sense. The management interface listens on the LAN side by default and is not WAN-exposed. For an enterprise security team managing 10,000 hosts, this CVE applies to approximately zero of them. The 9.8 is a vendor score divorced from operational reality.

Why this verdict

• Enterprise installed base is effectively zero. The GL-MT3000 is a pocket travel router sold on Amazon and Walmart. It is not purchased, deployed, or managed by enterprise IT teams. An enterprise managing 10,000 hosts has zero of these in their CMDB.
• No high-value role applies. This device is not a network edge appliance (not F5, Palo Alto, Cisco ASA), not identity infrastructure, not a hypervisor, not CI/CD, not backup infrastructure. It occupies no role in the high-value-role catalog. The blast radius of compromise is one travel router and its handful of directly connected Wi-Fi clients.
• Role multiplier: N/A. The GL-MT3000 is exclusively a consumer/prosumer device. Even in the rare case an employee carries one for travel, it is not domain-joined, does not hold enterprise credentials, and is not in the trust boundary of the corporate network. Compromise yields root on an embedded Linux box with no lateral movement path to enterprise assets.
• LAN-only management interface by default. The attack surface requires Layer 3 access to the router's LAN IP. This limits the attacker to the same local network segment — a hotel Wi-Fi or coffee shop — not the internet at large.

Why not higher?

Despite the public exploit and unauthenticated RCE, there is no enterprise deployment scenario where this device occupies a security-critical role. The blast radius is a single consumer gadget. Elevating this to MEDIUM or above would misallocate enterprise patching resources toward a device class that doesn't exist in managed fleets.

Why not lower?

A public exploit for unauthenticated RCE exists, and the device *could* appear as shadow IT carried by traveling employees. If an attacker on a shared network (hotel, airport) compromises a travel router, they could intercept the employee's traffic or pivot to the employee's laptop. This residual risk prevents an IGNORE verdict.

1. Inventory and remove GL.iNet devices from corporate use — Query endpoint agents, travel expense reports, and procurement records for GL.iNet purchases. If any are found, replace with enterprise-managed VPN solutions. No noisgate mitigation SLA applies at LOW severity — treat as backlog hygiene.
2. Block GL.iNet management interfaces on corporate Wi-Fi — If employees connect GL-MT3000 routers to corporate networks as repeaters, NAC policies should block rogue DHCP servers and unknown router MACs (GL.iNet OUI: E4:95:6E, 94:83:C4).
3. Advise traveling staff to upgrade firmware — If the organization cannot eliminate these devices, advise affected users to upgrade to firmware 4.7+ which resolves related command injection CVEs and likely patches this one.

Run this from any machine on the same LAN as the GL-MT3000 (e.g., connected to its Wi-Fi). No special privileges needed. Usage: bash check_glmt3000.sh 192.168.8.1

#!/usr/bin/env bash
# check_glmt3000.sh — Check GL-MT3000 for CVE-2026-18686 vulnerability
# Usage: bash check_glmt3000.sh <router_ip>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

ROUTER_IP="${1:-192.168.8.1}"
ENDPOINT="http://${ROUTER_IP}/cgi-bin/api/router/hello"

echo "[*] Checking GL-MT3000 at ${ROUTER_IP}..."

# Step 1: Query the router's API for firmware version
RESPONSE=$(curl -s -m 10 "${ENDPOINT}" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "UNKNOWN — Could not reach device at ${ROUTER_IP}. Is it a GL-MT3000?"
  exit 2
fi

# Extract firmware version from JSON response
FW_VERSION=$(echo "$RESPONSE" | grep -oP '"firmware_version"\s*:\s*"\K[^"]+' 2>/dev/null || true)
MODEL=$(echo "$RESPONSE" | grep -oP '"model"\s*:\s*"\K[^"]+' 2>/dev/null || true)

if [ -z "$FW_VERSION" ]; then
  echo "UNKNOWN — Could not parse firmware version from device response."
  exit 2
fi

echo "[*] Model: ${MODEL:-unknown}"
echo "[*] Firmware: ${FW_VERSION}"

# Step 2: Compare version — vulnerable range is 4.4.0 through 4.4.5
# Fixed in 4.7+
MAJOR=$(echo "$FW_VERSION" | cut -d. -f1)
MINOR=$(echo "$FW_VERSION" | cut -d. -f2)
PATCH=$(echo "$FW_VERSION" | cut -d. -f3)

if [ "$MAJOR" -lt 4 ] 2>/dev/null; then
  echo "UNKNOWN — Firmware version ${FW_VERSION} is below known affected range."
  exit 2
elif [ "$MAJOR" -eq 4 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -le 5 ] 2>/dev/null; then
  echo "VULNERABLE — Firmware ${FW_VERSION} is in the affected range (4.4.0–4.4.5)."
  exit 0
elif [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 7 ] 2>/dev/null; then
  echo "PATCHED — Firmware ${FW_VERSION} is at or above 4.7 (expected fix version)."
  exit 1
elif [ "$MAJOR" -gt 4 ] 2>/dev/null; then
  echo "PATCHED — Firmware ${FW_VERSION} is above the affected major version."
  exit 1
else
  echo "UNKNOWN — Cannot determine vulnerability status for firmware ${FW_VERSION}."
  exit 2
fi

Sources

1. OffSeq Threat Radar — CVE-2026-18686
2. THREATINT — CVE-2026-18686
3. TheHackerWire — CVE-2026-18614 (related GL-MT3000 RCE)
4. SecurityVulnerability.io — GL.iNet Latest Vulnerabilities
5. GL.iNet GL-MT3000 Router Documentation
6. VulDB — CVE-2026-12187 GL-MT3000 command injection
7. FIRST.org — EPSS