CVE-2026-26795

CVE-2026-26795 is a command injection vulnerability affecting the GL-iNet GL-AR300M16 router running firmware version 4.3.11. The flaw exists in the M.get_system_log function, where the module parameter fails to properly sanitize user input, enabling attackers to inject and execute arbitrary operating system commands. This issue, classified under CWE-77 (Command Injection), carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.

The vulnerability can be exploited by unauthenticated attackers over the network with low complexity and no user interaction required. By crafting malicious input for the module parameter, an attacker can execute arbitrary commands on the device, potentially leading to full system compromise, including data theft, modification of configurations, or further lateral movement within a network. The unchanged scope and high impacts on confidentiality, integrity, and availability underscore its risk to Internet-exposed IoT devices.

A proof-of-concept demonstrating the vulnerability is available in the GitHub repository at https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/logread--get_system_log. No vendor advisories or patches were referenced in the CVE details.