Home / Vulnerability Intelligence / CVE-2026-26793

CVE-2026-26793 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 13, 2026

GL-iNet GL-AR300M16 - Command Injection

Published: March 12, 2026Updated: March 13, 2026PoC AvailableRemote Exploitable

Overview

GL-iNet GL-AR300M16 v4.3.11 contains a command injection caused by improper input handling in the set_config function, letting attackers execute arbitrary commands remotely, exploit requires crafted input.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 22.7%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_config

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🔴 CVE-2026-26793 - Critical (9.8) GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26793/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID: CVE-2026-26793
Severity: Critical
CVSS Score: 9.8
Type: command_injection
Status: confirmed
EPSS: 22.7%
Social Posts: 1

CWE

CWE-77

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

22.7%Probability of exploitation in the next 30 days