PT-2026-25049 · Gl.Inet · Ar300M16 Firmware

Sezangel · Publicado 2026-03-12 · Atualizado 2026-03-13 · CVE-2026-26793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AR300M16 version 4.3.11

Description The GL-iNet GL-AR300M16 device, version 4.3.11, contains a command injection issue through the set config function. This allows attackers to execute arbitrary commands by providing a crafted input. The vulnerability is triggered via manipulation of input to the set config function.

Recommendations Update to a newer version of the GL-iNet GL-AR300M16 firmware that addresses this issue. As a temporary workaround, consider restricting access to the set config function until a patch is available.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-26793

Produtos afetados

Ar300M16 Firmware

Referências · 8

• 🔥 https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_config · Exploit
• https://twitter.com/infoflowcloud/status/2032411904149225533 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2032249895172599929 · Publicação no Twitter
• https://t.me/cveNotify/155365 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2032199924948074700 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032410987568189768 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26793 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26793 · Aviso do Fabricante