Command Injection Vulnerability in GL-iNet GL-AR300M16 by GL-iNet
CVE-2026-26793

9.8CRITICAL

Key Information:

Vendor

GL-iNet

Status
GL-AR300M16
Vendor
CVE Published:
12 March 2026

What is CVE-2026-26793?

The GL-iNet GL-AR300M16 version 4.3.11 is susceptible to a command injection flaw, specifically through the set_config function. This vulnerability enables adversaries to execute arbitrary commands on the device by providing specially crafted input, potentially leading to unauthorized access and manipulation of the system. To mitigate risks, users should avoid exposing this function to untrusted sources and apply appropriate security measures.

References

https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.