PT-2026-25025 · Gl.Inet · Ar300M16 Firmware

Sezangel · Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-26792

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AR300M16 version 4.3.11

Description The GL-iNet GL-AR300M16 device contains multiple command injection flaws within the set upgrade function. These flaws are triggered through manipulation of the modem url, target version, current version, firmware upload, hash type, hash value, and upgrade type parameters. Successful exploitation allows attackers to execute arbitrary commands.

Recommendations Versions prior to 4.3.11 are potentially affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-26792

Affected Products

Ar300M16 Firmware

References · 6

• 🔥 https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade · Exploit
• https://osv.dev/vulnerability/CVE-2026-26792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26792 · Security Note
• https://twitter.com/infoflowcloud/status/2032411849182904530 · Twitter Post
• https://twitter.com/CVEnew/status/2032410986666488147 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032536173533606345 · Twitter Post