Deviceways

Travel router

GL.iNet GL-MT3000

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

Hardware(Beryl AX)

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
(Beryl AX)
Hardware revision not specified
Release listed · 25.12.5
Open hardware recordopenwrt.org
Original project github.com
Sources
App or integration
Maintainer-reported device test

See connected devices and control your router’s Wi-Fi or VPN from Home Assistant.

Applies toGL.iNet firmware 4.x only. Author reports GL-MT3000 testing on 4.8.1.

How to get started

Add this project as a custom HACS integration, restart Home Assistant, then enter the router’s address and admin password.

Setup
Home Assistant integration; keeps the router’s firmware
You’ll need
Home Assistant 2026.9+, HACS and router admin access.
Original project github.com

Features & details

Check the project and hardware shown for each feature.

Device details

GL.iNet GL-MT3000 (Beryl AX) — TechInfoDepot (github.com)

Hardware revision
(Beryl AX)

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.8 (v3.1)

GL.iNet GL-MT3000

Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid…

CVE-2023-46453

Affected firmware
Version details in source scope
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200.

CVE published

CVSS 9.3 (v4.0)

GL-MT3000

GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection

CVE-2026-18686

Affected firmware
4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

VDB-385612 | GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection — GL-MT3000 (vuldb.com) ↗VDB-385612 | CTI Indicators (IOB, IOC, TTP, IOA) — GL-MT3000 (vuldb.com) ↗CVE-2026-18686 | CVE Analysis and Report — GL-MT3000 (vuldb.com) ↗Submit #856139 | GL.iNet MT3000 4.4.5 Command Injection — GL-MT3000 (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

GL-MT3000

GL.iNet GL-MT3000 modem.so glc set_upgrade command injection

CVE-2026-18685

Affected firmware
4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

VDB-385611 | GL.iNet GL-MT3000 modem.so glc set_upgrade command injection — GL-MT3000 (vuldb.com) ↗VDB-385611 | CTI Indicators (IOB, IOC, TTP, IOA) — GL-MT3000 (vuldb.com) ↗CVE-2026-18685 | CVE Analysis and Report — GL-MT3000 (vuldb.com) ↗Submit #851593 | GL.iNet MT3000 4.4.5 Command Injection — GL-MT3000 (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

GL-MT3000

GL.iNet GL-MT3000 modem.so glc remove_profile command injection

CVE-2026-18684

Affected firmware
4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

VDB-385610 | GL.iNet GL-MT3000 modem.so glc remove_profile command injection — GL-MT3000 (vuldb.com) ↗VDB-385610 | CTI Indicators (IOB, IOC, TTP, IOA) — GL-MT3000 (vuldb.com) ↗CVE-2026-18684 | CVE Analysis and Report — GL-MT3000 (vuldb.com) ↗Submit #851581 | GL.iNet GL-MT3000 4.4.5 Command Injection — GL-MT3000 (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

GL-MT3000

GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

CVE-2026-18616

Affected firmware
4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

VDB-385536 | GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection — GL-MT3000 (vuldb.com) ↗VDB-385536 | CTI Indicators (IOB, IOC, TTP, IOA) — GL-MT3000 (vuldb.com) ↗CVE-2026-18616 | CVE Analysis and Report — GL-MT3000 (vuldb.com) ↗Submit #851580 | GL-iNet MT3000 4.4.5 Command Injection — GL-MT3000 (vuldb.com) ↗
Check more security advisories for this device · CVE.org