CVE-2026-26791 is a critical command injection vulnerability found in GL-iNet GL-AR300M16 firmware version 4.3.11. This flaw allows an attacker to execute arbitrary commands by manipulating the `string port` parameter within the `enable_echo_server` function. With a CVSS score of 9.8, it poses a severe risk, enabling unauthenticated, remote attackers to achieve full compromise of confidentiality, integrity, and availability. While there are no known public exploits or evidence of active exploitation (KEV: No), the vulnerability has received some community attention and discussion. Organizations using the affected firmware should prioritize patching or mitigation strategies.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.3.11CPE matchmatch criteria | cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.