CVE Intelligence

GL.iNet Ar300m16 Firmware vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting GL.iNet Ar300m16 Firmware: 5 record(s), with affected versions and fixes.
cpe:2.3:o:gl-inet:ar300m16_firmware

CVE-2026-26793 Critical · 9.8 CWE-77 Mar 12, 2026
Command Injection in GL.iNet Ar300m16 Firmware
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-26795 Critical · 9.8 CWE-77 Mar 12, 2026
Command Injection in GL.iNet Ar300m16 Firmware
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-26794 High · 8.8 CWE-89 Mar 12, 2026
SQL Injection in GL.iNet Ar300m16 Firmware
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.
CVE-2026-26792 Critical · 9.8 CWE-77 Mar 12, 2026
Command Injection in GL.iNet Ar300m16 Firmware
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
CVE-2026-26791 Critical · 9.8 CWE-77 Mar 12, 2026
Command Injection in GL.iNet Ar300m16 Firmware
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.