CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18614 — A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the func...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and conf

Analysis

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSS Score: 9.8. Published: 2026-08-03T19:16:45.200.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18614
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New Tool Traces AI Videos Back to Their Source

Researchers dug into the root of the problem with the goal of promoting industry collaboration on improved protective measures.

Dark Reading
HIGHVulnerability

NVD HIGH: CVE-2026-67599 — ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer com...

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webcon

CVE-2026-67599
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-67598 — Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerab...

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSe

CVE-2026-67598
NIST NVD