CVE-2026-18601 | GL.iNet GL-MT3000 up to 4.4.5 ovpn-client.so Native Plugin /cgi-bin/glc ovpn-client.check_config filename command injection (EUVD-2026-52271)

A vulnerability marked as critical has been reported in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection.

This vulnerability is known as CVE-2026-18601. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.