PT-2026-25025 · Gl.Inet · Ar300M16 Firmware

Sezangel · Publicado 2026-03-12 · Atualizado 2026-03-13 · CVE-2026-26792

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AR300M16 version 4.3.11

Description The GL-iNet GL-AR300M16 device contains multiple command injection flaws within the set upgrade function. These flaws are triggered through manipulation of the modem url, target version, current version, firmware upload, hash type, hash value, and upgrade type parameters. Successful exploitation allows attackers to execute arbitrary commands.

Recommendations Versions prior to 4.3.11 are potentially affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-26792

Produtos afetados

Ar300M16 Firmware

Referências · 6

• 🔥 https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade · Exploit
• https://twitter.com/infoflowcloud/status/2032411849182904530 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26792 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-26792 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032410986666488147 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2032536173533606345 · Publicação no Twitter