PT-2026-25049 · Gl.Inet · Ar300M16 Firmware

Sezangel · Published 2026-03-12 · Updated 2026-03-13 · CVE-2026-26793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AR300M16 version 4.3.11

Description The GL-iNet GL-AR300M16 device, version 4.3.11, contains a command injection issue through the set config function. This allows attackers to execute arbitrary commands by providing a crafted input. The vulnerability is triggered via manipulation of input to the set config function.

Recommendations Update to a newer version of the GL-iNet GL-AR300M16 firmware that addresses this issue. As a temporary workaround, consider restricting access to the set config function until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-26793

Affected Products

Ar300M16 Firmware

References · 8

• 🔥 https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_config · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26793 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26793 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2032411904149225533 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2032249895172599929 · Twitter Post
• https://t.me/cveNotify/155365 · Telegram Post
• https://twitter.com/TheHackerWire/status/2032199924948074700 · Twitter Post
• https://twitter.com/CVEnew/status/2032410987568189768 · Twitter Post