VulnSocial

CVE-2026-18614PoC

LOWCVSS 8.9 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-03: 1Mentions · 2026-08-05: 1PoC Mentioned / Linked · 2026-08-03: 1Technical Details · 2026-08-05: 108-0308-05
Signal classification2 categories
PoC
150.0%
Disclosure
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-031
PoC1
2026-08-051
Disclosure1
Full discourse2 posts
  • SecAlerts@SecAlertsCo
    Disclosure

    🛜 GL-iNet GL-MT3000 (up to 4.4.5) has a command injection flaw in s2s.enable_echo_server via /cgi-bin/glc — no auth, network accessible, CVSS 8.9. CVE-2026-18614 #cybersecurity #vulnerabilities #ciso https://secalerts.co/vulnerability/CVE-2026-18614?utm_campaign=x https://t.co/MzWZfIT5qJ

    Post summary

    The tweet announces a command injection vulnerability (CVE-2026-18614) in GL-iNet GL-MT3000 routers, providing technical details but no PoC, patch, or evidence of active exploitation.

    00000122
    874 followersView on X
  • MalwareObserver@MalwareObserver
    PoC

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-18614](https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/s2s_enable_e... https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/s2s_enable_echo_server_glc_rce/CVE.md #CVE #ZeroDay #PatchManagement

    Post summary

    The tweet announces CVE-2026-18614 and directs readers to a GitHub repository that likely contains a proof‑of‑concept exploit, but it does not provide technical details, active exploitation reports, or patch information.

    0000047
    18 followersView on X

Explore more

Back to dashboard