CVE-2026-18685

CVE-2026-18685 is a command injection in the set_upgrade function of modem.so, reachable through the /cgi-bin/glc CGI endpoint on GL.iNet devices. The CVSS 9.8 rating is technically accurate — this is a firmware update handler that almost certainly executes with elevated privileges, and successful exploitation grants root-level command execution. But the EPSS score of 0.01989 (roughly 2% probability in 30 days) creates a puzzle that demands attention rather than dismissal. The most likely explanation for the EPSS gap is that this endpoint requires authentication, which the model weights heavily as a barrier. But treat this as a caution, not a comfort. Authentication boundaries on consumer networking gear are consistently the weakest link in the stack — the same product ecosystem that produces command injection in firmware update handlers also produces default credential CVEs and session handling flaws at a rate that should make you skeptical of any single-point authentication defense. The historical pattern is well-documented: high-sevency command injection in router web interfaces correlates with adjacent authentication bypass CVEs within 12-18 months. The public exploit disclosure changes the calculus entirely. EPSS models probabilistic exploitation based on patterns, but a disclosed exploit in the wild creates non-probabilistic risk. The moment this went public, the 2% number became largely irrelevant for anyone assessing real exposure. The blast radius here is the critical dimension that CVSS and EPSS both underweight. This isn't a compromised camera or smart bulb — it's a modem, the chokepoint for network egress. Compromising this device positions an attacker as a potential man-in-the-middle on every connection from every device on that network. The command injection becomes a force multiplier for any adjacent compromise, not just a standalone remote code execution. Your immediate priorities: verify whether firmware 4.4.6 or later is actually deployed on your GL.iNet devices and confirmed patched by the vendor — not just acknowledged. If you cannot confirm a patch timeline from the vendor, treat this as a known-unpatched vulnerability with a public exploit. Segment affected devices aggressively. Monitor for the authentication bypass CVEs that historically follow this pattern. The remediation window, not the EPSS probability, is now the variable that determines your exposure.

Reviewed through automated stages and approved by a human before publication.