GL.iNet MT3000 CVE-2026-11406

Exploitation requires the attacker to hold at least low-level authenticated access (PR:L per CVSS vector) to the GL.iNet MT3000 web management interface - unauthenticated exploitation is not supported by the available data. The OpenVPN Client Import Workflow (the feature exposing ovpnclient.sh) is a standard, default-enabled capability of the firmware and does not require any non-default configuration to be present. The attack is network-delivered (AV:N) with low complexity (AC:L), meaning the management interface need only be network-reachable - no physical access, special network position, or race condition is required. The authentication requirement is the primary limiting factor: an attacker must first compromise or possess valid login credentials. Risk is substantially elevated when the router's management interface is directly internet-exposed (common in travel router deployments) or when default admin credentials remain unchanged. No victim user interaction is required beyond the attacker's own actions (UI:N).

The CVSS 3.1 base score of 6.3 (Medium) reflects network-reachable exploitation (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L - authenticated), no user interaction (UI:N), and unchanged scope with low-level confidentiality, integrity, and availability impact. Temporal metrics reinforce practical concern: E:P confirms an existing proof-of-concept, RL:O confirms an official fix is released, and RC:C confirms the vulnerability is vendor-acknowledged. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. CISA KEV listing is absent, meaning widespread in-the-wild exploitation is not confirmed. However, the Medium base score likely understates real-world risk in internet-exposed deployments: MT3000 is a consumer IoT travel router where management interfaces are frequently exposed to untrusted networks, default or weak credentials are common, and the public GitHub POC substantially lowers the barrier for opportunistic attackers. The authentication requirement (PR:L) is the primary limiting factor distinguishing this from a critical-rated vulnerability - defenders should treat credential hygiene and management interface exposure as the key risk levers.

An attacker who has obtained low-privilege credentials for the GL.iNet MT3000 management interface - through credential stuffing, default password exploitation, or phishing - authenticates to the web UI and navigates to the OpenVPN Client Import feature. They upload a crafted .ovpn configuration file with shell injection payloads embedded in fields processed by ovpnclient.sh (for example, in the remote, dev, or cert directive values), causing arbitrary OS commands to execute on the router with the script's runtime privileges. Given the public POC hosted on GitHub, this scenario is reproducible by low-skill actors following documented steps.