PatchTheCVEgl-inet vulnerabilities
Recent CVEs affecting gl-inet products. 18 tracked.
gl-inet has 18 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-03-17. Highest priority: CVE-2026-26795 (score 69/100).
- CVE-2026-32293 LOW 3.7 UPGRADE The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificat
- CVE-2026-32292 HIGH 7.5 UPGRADE The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to g
- CVE-2026-32291 MEDIUM 6.8 UPGRADE The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console
- CVE-2026-32290 MEDIUM 4.7 UPGRADE The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded
- CVE-2026-26795 CRITICAL 9.8 MITIGATE GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module paramet
- CVE-2026-26794 HIGH 8.8 MITIGATE GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() functi
- CVE-2026-26793 CRITICAL 9.8 MITIGATE GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config fun
- CVE-2026-26792 CRITICAL 9.8 MITIGATE GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_up
- CVE-2026-26791 CRITICAL 9.8 MITIGATE GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port pa
- CVE-2025-67091 MEDIUM 6.5 MITIGATE An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable
- CVE-2025-67090 MEDIUM 5.1 MITIGATE The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable
- CVE-2025-67089 HIGH 8.1 MITIGATE A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8
- CVE-2024-45263 HIGH 8.8 MITIGATE UPGRADE An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.
- CVE-2024-45262 HIGH 8.8 UPGRADE UPGRADE An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.
- CVE-2024-45261 HIGH 8.0 UPGRADE UPGRADE An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.
- CVE-2024-45260 HIGH 8.0 MITIGATE MITIGATE An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.
- CVE-2024-45259 MEDIUM 6.5 MITIGATE UPGRADE An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.
- CVE-2024-28077 HIGH 7.5 MITIGATE MITIGATE A denial-of-service issue was discovered on certain GL-iNet devices
FAQ
How do I fix gl-inet vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gl-inet being exploited right now?
None of the tracked gl-inet CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gl-inet CVE should I patch first?
CVE-2026-26795 currently ranks highest (69/100): GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module paramet.