Home / Vulnerability Intelligence / CVE-2026-26792

CVE-2026-26792 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 13, 2026

GL-iNet GL-AR300M16 - Command Injection

Published: March 12, 2026Updated: March 13, 2026PoC AvailableRemote Exploitable

Overview

GL-iNet GL-AR300M16 v4.3.11 contains multiple command injection vulnerabilities caused by improper input handling in the set_upgrade function parameters, letting attackers execute arbitrary commands remotely, exploit requires crafted input.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 17.1%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🔴 CVE-2026-26792 - Critical (9.8) GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. T... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26792/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-26792
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: confirmed
EPSS: 17.1%
Social Posts: 2

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

17.1%Probability of exploitation in the next 30 days