A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-cl…

A command injection vulnerability (CVE-2026-18601) has been identified in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The vulnerability exists in the ovpn-client.check_config function within the /cgi-bin/glc file of the ovpn-client.so Native Plugin component. An attacker can exploit this by manipulating the 'filename' argument to inject arbitrary OS commands. The vulnerability is remotely exploitable without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The vendor was notified prior to disclosure and has confirmed the vulnerability exists. This poses a significant risk to users of affected GL.iNet MT3000 devices, particularly those exposed to the internet.