Affected Vendors This Week
- Cisco: 23 CVEs (5 critical, 15 high, 3 medium)
- GL.iNet: 16 CVEs (8 critical, 6 high, 2 medium)
- OpenWrt / DD-WRT: 3 CVEs (1 critical, 2 high)
- Zyxel: 3 CVEs (0 critical, 2 high, 1 medium)
- SonicWall: 1 CVE (0 critical, unrated)
This week brought a significant security event with 46 new router vulnerabilities, including 16 critical issues. Two vendors—Cisco and GL.iNet—dominate the week's disclosures, with particularly severe impacts on enterprise and small-office router deployments.
Critical Issues Requiring Immediate Attention
Cisco: Five Critical Flaws in Core Routing Products
Cisco's proactive security review uncovered five critical vulnerabilities across its product line. CVE-2026-20303 and CVE-2026-20304 (both CVSS 9.9) affect Cisco Catalyst SD-WAN platforms—mission-critical infrastructure for enterprises managing distributed networks. CVE-2026-20272 (CVSS 9.8) impacts IOS XE Software, which runs on Cisco's core routing and switching infrastructure. Additionally, CVE-2026-20310 (CVSS 9.1) and CVE-2026-20267 (CVSS 9.0) round out a serious cluster of SD-WAN and IOS XE exposures.
Action required: Network administrators managing Cisco infrastructure should prioritize patching these vulnerabilities immediately. Check Cisco's security advisories for affected device models and firmware versions, then plan emergency update windows if devices are in production.
GL.iNet GL-MT3000: Eight Critical Remote Code Execution Flaws
GL.iNet's GL-MT3000 router—popular in small offices and remote deployments—has been flagged for eight critical vulnerabilities affecting firmware versions up to 4.4.5. These include:
- CVE-2026-18685: Command injection via the modem upgrade function
- CVE-2026-18686: Remote user addition through the nas-web RPC interface
- CVE-2026-18684: Command injection in modem profile removal
- CVE-2026-18614, CVE-2026-18615, CVE-2026-18616: Multiple remote code execution flaws in WireGuard and S2S (site-to-site) server functions
- CVE-2026-18612, CVE-2026-18613: Plugin management and configuration vulnerabilities
All eight carry CVSS scores of 9.8, indicating near-maximum severity. The common thread is unauthenticated or low-privilege remote code execution via the web interface—meaning attackers could gain full control of affected routers with minimal friction.
Action required: GL.iNet users should update immediately to firmware 4.4.6 or later. Check your device firmware version in the web UI (typically under System Settings) and apply updates without delay. If devices are internet-facing, consider temporary network isolation pending patching.
Zbtlink ENDLESSDOORS Implant: Hardware-Level Compromise
CVE-2026-66747 (CVSS 9.8) reveals a particularly alarming issue: Zbtlink router firmware ships with a pre-installed, closed-source remote-control implant called ENDLESSDOORS. This tool—based on the open-source ycsunjane/rctl project—is present in every published firmware build. This is not a vulnerability introduced by developers; it appears intentional, making affected Zbtlink devices inherently compromised at the firmware level.
Action required: Organizations using Zbtlink routers should immediately evaluate alternatives. This is not a patchable vulnerability—it requires hardware replacement or a complete firmware fork, neither of which is realistic for most deployments. Do not deploy additional Zbtlink devices pending further investigation.
High-Severity Issues
Beyond the critical tier, 19 high-severity CVEs warrant attention:
- Cisco (6 high): Including CVE-2026-20200 (IMC web interface RCE), CVE-2026-20301 (XMCP protocol flaw in IOS), and CVE-2026-20312 (SD-WAN issue)
- GL.iNet (6 high): Additional GL-MT3000 flaws beyond the critical cluster
- OpenWrt (2 high): CVE-2026-69096 (Docker RPC vulnerability in luci-app-dockerman) and CVE-2026-69095 (path traversal in luci-app-bmx7)
- Zyxel (2 high): CVE-2026-14818 (CLI path traversal in ATP series) and CVE-2026-6837 (command injection in WAX650S export utility)
These should be included in your standard patch cycles but are not as time-critical as the critical-tier issues.
Recommended Immediate Steps
- Inventory your fleet: Confirm which Cisco, GL.iNet, OpenWrt, and Zyxel devices you operate. Prioritize production and internet-facing systems.
- Check for patches: Visit each vendor's security portal. Cisco, GL.iNet, and OpenWrt typically publish fixes within 24–48 hours of disclosure.
- Stage updates: In lab or non-critical environments, test firmware updates before rolling out to production.
- Isolate Zbtlink devices: If you have any Zbtlink routers, isolate them from sensitive network segments pending a vendor response or replacement decision.
- Monitor for exploits: Watch threat intel feeds and vendor advisories for proof-of-concept code. The CVSS 9.8+ issues are attractive targets for attackers.
This is a significant week for router security. Treat the Cisco and GL.iNet critical CVEs as emergency patches, and plan accordingly with your stakeholders.