GL-iNet GL-MT3000 wg-server.so Command Injection (CVE-2026-18616)

Technical Analysis

CVE-2026-18616 stems from improper sanitization of the public_key argument passed to server.set_peer within the wg-server.so component, which handles WireGuard VPN peer configuration via the /cgi-bin/glc CGI endpoint. Because the parameter is passed unsafely to a system-level call, attackers can inject shell metacharacters to execute arbitrary commands with the privileges of the CGI process, typically root on embedded Linux router firmware. The vendor has confirmed the vulnerability and remote exploitation is possible without complex prerequisites, and public exploit code lowers the barrier for mass scanning and automated attacks. Organizations using these routers to provide network connectivity for edge AI agent deployments, RAG pipelines, or remote agent orchestration nodes could see attacker-controlled network pivoting, traffic interception, or credential/API key exfiltration if agent infrastructure traffic traverses a compromised device.

Affected Systems

GL-iNet GL-MT3000 travel routers running firmware up to and including version 4.4.5; specifically the wg-server.so Native Plugin component and its /cgi-bin/glc CGI interface used for WireGuard VPN peer management.

Indicators of Compromise

• Endpoint: /cgi-bin/glc
• Affected component: wg-server.so (Native Plugin)
• Exploited parameter: public_key (in server.set_peer function call)

Remediation Steps

1. 1

   Apply Vendor Patch

   Update GL-MT3000 firmware to the latest version released by GL-iNet that addresses CVE-2026-18616 as soon as it becomes available.

2. 2

   Restrict Management Interface Access

   Disable remote/WAN access to the CGI administrative interface and restrict access to trusted internal networks or VPN-only management.

3. 3

   Network Segmentation

   Isolate GL-MT3000 devices, especially those supporting agent or automation infrastructure, on segmented VLANs separate from critical AI/agent workloads.

4. 4

   Monitor for Exploitation

   Inspect logs and network traffic for anomalous requests to /cgi-bin/glc and unexpected command execution or outbound connections from the router.

5. 5

   Rotate Exposed Credentials

   If the router handled VPN configurations or credentials used by agent systems, rotate WireGuard keys, API keys, and any secrets that may have traversed the compromised device.