Gl.inet - Gl-mt3000 - CRITICAL - CVE-2026-18602. A command injection vulnerability exists in the GL.iNet GL-MT3000 router's ovpn-client native plugin. This vulnerability is triggered when an attacker manipulates the Hostname argument within the ovpn-client.get_recommend_config function. The flaw allows for remote exploitation, enabling unauthorized command execution. The vendor has acknowledged the presence of this vulnerability and it has been publicly disclosed, attracting attention from potential attackers. Users are advised to take preventive measures to mitigate the risk of exploitation. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io