GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
References
| Link | Resource |
|---|---|
| https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
13 Mar 2026, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-77 | |
| First Time |
Gl-inet ar300m16
Gl-inet Gl-inet ar300m16 Firmware |
|
| Summary |
|
|
| CPE | cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* cpe:2.3:h:gl-inet:ar300m16:-:*:*:*:*:*:*:* |
12 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-12 18:16
Updated : 2026-03-13 18:57
NVD link : CVE-2026-26792
Mitre link : CVE-2026-26792
CVE.ORG link : CVE-2026-26792
JSON object : View
Products Affected
gl-inet
- ar300m16_firmware
- ar300m16
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')