Summary
CVE-2026-18615 is an unauthenticated OS command injection vulnerability in the GL.iNet GL-MT3000 (Beryl AX) router firmware. The flaw resides in the wg-server.generate_publickey method exposed through the /cgi-bin/glc RPC endpoint and allows a remote attacker to execute arbitrary commands as root. It is rated Critical.
Technical details
- Root cause: The
generate_publickeyfunction in thewg-server.sonative plugin (/usr/lib/oui-httpd/rpc/wg-server.so) interpolates the attacker-suppliedprivate_keyvalue directly into a shell command of the formecho %s | wg pubkeywithout sanitization. - Trigger conditions: A
private_keyvalue containing shell metacharacters (for example$(...)command substitution) is expanded by the shell before thewg pubkeypipe executes, yielding blind command execution. - Attack vector: Network-based via the unauthenticated
/cgi-bin/glcRPC endpoint; no authentication or user interaction is required. Injection is delivered through theprivate_keyfield in the JSONargsobject of awg-server.generate_publickeyrequest. - Impact: Arbitrary command execution as root, leading to full remote code execution and complete compromise of device confidentiality, integrity, and availability.
Affected software
- GL.iNet GL-MT3000 (Beryl AX) firmware versions 4.4.0 through 4.4.5.
Severity
- CVSS v3.1 base score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Monitor GL.iNet for a firmware release addressing this issue and upgrade GL-MT3000 devices as soon as a fixed version is published. At the time of writing, no fixed firmware version is confirmed in the CVE record.
- If no patch: Do not expose the router’s administrative/RPC interface (
/cgi-bin/glc) to the internet. Restrict management access to trusted networks or VPN, place the device behind a firewall, and monitor for anomalous requests to thewg-server.generate_publickeymethod.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Page title:
GL.iNet,GL-MT3000,Beryl AX,GL.iNet Admin Panel

