CVE-2026-18600 is a command injection vulnerability in the GL-MT3000 router's embedded HTTP daemon, specifically in the Lua RPC handler for network switch operations at /usr/lib/oui-httpd/rpc/network. The vulnerability allows unsanitized HTTP parameters to reach shell execution primitives (os.execute or io.popen), turning what could be an input validation failure into full remote code execution.
The CVSS 8.8 score and confirmed public exploit availability mean this is not theoretical — active exploitation is underway or imminent. For a router serving as a network gateway, compromise means immediate lateral movement to every device on the LAN, DNS poisoning capability, and the ability to terminate and inspect VPN tunnels. The blast radius is structurally larger than almost any other IoT device category because the router sits at the trust anchor of the entire network.
Two questions demand urgent investigation. First, verify whether the RPC interface requires authentication in your deployment — if this endpoint is reachable without credentials, you have an unauthenticated RCE and the exposure window predates any patch. Second, assess whether GL.iNet's firmware 4.4.5 addresses the architectural pattern (Lua RPC handlers invoking shell) or only patches this specific function. Historical precedent strongly suggests the latter: vendors consistently apply surgical string sanitization at the injection point while leaving the Lua-to-shell invocation pattern intact. This means adjacent RPC methods in the same daemon likely contain similar vulnerabilities.
If you cannot patch immediately, restrict access to the HTTP management interface to a management VLAN or disable remote administration entirely. Monitor for unexpected processes, new cron jobs, or unusual outbound connections originating from the router. The GL-MT3000 targets security-conscious users, creating an inverted trust problem where the users most likely to deploy this hardware are least likely to detect an embedded compromise — assume the device may be compromised if exploitation is known to be public and you have not yet applied the 4.4.5 update.