CVE-2026-18600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18600", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-03T06:55:19.221Z", "datePublished": "2026-08-03T13:00:10.440Z", "dateUpdated": "2026-08-03T14:50:38.393Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T13:00:10.440Z"}, "title": "GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "GL.iNet", "product": "GL-MT3000", "versions": [{"version": "4.4.0", "status": "affected"}, {"version": "4.4.1", "status": "affected"}, {"version": "4.4.2", "status": "affected"}, {"version": "4.4.3", "status": "affected"}, {"version": "4.4.4", "status": "affected"}, {"version": "4.4.5", "status": "affected"}], "cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["Network Lua RPC Plugin"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-08-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-03T09:00:41.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "strforexc (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/385515", "name": "VDB-385515 | GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385515/cti", "name": "VDB-385515 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18600", "name": "CVE-2026-18600 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/851537", "name": "Submit #851537 | GL.iNet GL-MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/network_switch_info_rpc_rce/CVE.md", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T14:50:24.392929Z", "id": "CVE-2026-18600", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T14:50:38.393Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18600", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T14:50:24.392929Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T14:50:30.713Z"}}], "cna": {"title": "GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection", "credits": [{"lang": "en", "type": "reporter", "value": "strforexc (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "vendor": "GL.iNet", "modules": ["Network Lua RPC Plugin"], "product": "GL-MT3000", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}]}], "timeline": [{"lang": "en", "time": "2026-08-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-03T09:00:41.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/385515", "name": "VDB-385515 | GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385515/cti", "name": "VDB-385515 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18600", "name": "CVE-2026-18600 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/851537", "name": "Submit #851537 | GL.iNet GL-MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/network_switch_info_rpc_rce/CVE.md", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T13:00:10.440Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18600", "state": "PUBLISHED", "dateUpdated": "2026-08-03T14:50:38.393Z", "dateReserved": "2026-08-03T06:55:19.221Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-03T13:00:10.440Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["Network Lua RPC Plugin"], "product": "GL-MT3000", "vendor": "GL.iNet", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en GL.iNet GL-MT3000 hasta la versi\u00f3n 4.4.5. Esto afecta la funci\u00f3n network.switch_info/network.switch_status del archivo /usr/lib/oui-httpd/rpc/network del componente Network Lua RPC Plugin. Dicha manipulaci\u00f3n del argumento switch conduce a inyecci\u00f3n de comandos. El ataque puede ser lanzado remotamente. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta revelaci\u00f3n y confirm\u00f3 la existencia de la vulnerabilidad."}], "id": "CVE-2026-18600", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18600", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T14:50:24.392929Z", "version": "2.0.3"}}]}, "published": "2026-08-03T14:16:25.763", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/network_switch_info_rpc_rce/CVE.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-18600"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/851537"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385515"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385515/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "GL-MT3000", "source": "cna", "vendor": "GL.iNet"}, "product": "gl-mt3000", "vendor": "gl-inet"}], "created": "2026-08-03T14:30:17.952875+00:00", "updated": "2026-09-24T19:00:16.837360+00:00", "vendors": ["gl-inet", "gl-inet$PRODUCT$gl-mt3000"]}