VulnSocial

CVE-2026-18601PoC

LOWCVSS 8.9 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-08-04)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-08-03: 1Mentions · 2026-08-04: 2PoC Mentioned / Linked · 2026-08-03: 1PoC Mentioned / Linked · 2026-08-04: 1Exploit Tool / Code · 2026-08-03: 1Technical Details · 2026-08-04: 208-0308-04
Signal classification2 categories
PoC
266.7%
Disclosure
133.3%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-08-031
PoC1
2026-08-042
Disclosure1PoC1
Full discourse3 posts
  • Hephaestvs@Vulcanux_
    PoC

    csirt_it: #GL-iNet: PoC pubblici per lo sfruttamento delle CVE-2026-18601, CVE-2026-18602, CVE-2026-18612, CVE-2026-18616 Rischio: 🔴 Tipologia: 🔸Remote Code Execution 🔗https://www.acn.gov.it/portale/en/w/gl-inet-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-18601-cve-2026-18602-cve-2026-18612-cve-2026-18616 🔄 Aggiornamenti disponibili 🔄 https://t.co/hyI0AfGXoC

    Post summary

    The post announces public Proof of Concept code for multiple CVE-2026-186xx vulnerabilities, highlighting Remote Code Execution and linking to a page with the PoCs.

    0101168
    629 followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🔌 GL.iNet GL-MT3000 routers up to 4.4.5 are exposed to unauthenticated command injection via ovpn-client.check_config in /cgi-bin/glc. CVSS 8.9, no auth needed. CVE-2026-18601 #cybersecurity #vulnerabilities #ciso #msp https://secalerts.co/vulnerability/CVE-2026-18601?utm_campaign=x https://t.co/cbysFiAVM0

    Post summary

    The tweet discloses that GL.iNet GL‑MT3000 routers up to firmware 4.4.5 are vulnerable to an unauthenticated command injection (CVE‑2026‑18601) with a CVSS 8.9 score, but it provides no PoC, exploit code, active exploitation evidence, or patch information.

    00020133
    894 followersView on X
  • SecureShield@SecureShield_
    PoC

    一次情報(NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-18601 参照元(ベンダー等): https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_check_config_glc_rce/CVE.md, https://vuldb.com/cve/CVE-2026-18601

    Post summary

    The post references CVE-2026-18601 via NVD and a GitHub repository that likely contains a proof‑of‑concept code, indicating a PoC availability but no evidence of active exploitation or a patch.

    0000044
    25 followersView on X

Explore more

Back to dashboard