GL.iNet GL-MT3000 CVE-2026-11447

Exploitation requires an authenticated session with at minimum low-privilege credentials (confirmed by PR:L in the CVSS vector). The attacker must be able to reach the router's management plane over the network (AV:N, AC:L), which is typically accessible on LAN by default and may be exposed on WAN if remote management is enabled. The vulnerable code path is specifically in the MTK WiFi backend function iwinfo_backend within iwinfo.so, triggered when a 'device' argument is processed - meaning the WiFi subsystem must be active and the backend callable. No user interaction is required (UI:N). Exploitation is limited by the need to hold valid credentials; unauthenticated exploitation is NOT indicated by the available data. Routers with remote management disabled and no exposed management ports to untrusted networks have significantly reduced exposure. Firmware versions 4.7 and above are not affected per vendor confirmation.

The CVSS base score of 6.3 (Medium) is driven by AV:N/AC:L/PR:L/UI:N, meaning the attack is network-accessible, low complexity, requires only low-privilege credentials, and needs no user interaction - a meaningful attack surface for any internet-exposed management interface. The impact triad (C:L/I:L/A:L) reflects partial compromise at the CVSS level, though command injection on a router typically enables privilege escalation to root in practice, making real-world impact likely higher than the base score implies. No EPSS score was provided in the source data, so exploitation probability cannot be quantitatively stated. The CVE is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed widespread active exploitation. However, the publicly available POC on GitHub (linked exploit reference) materially lowers the bar for exploitation, and consumer-grade IoT routers frequently remain unpatched. The combination of low complexity, no user interaction, public exploit, and a large unpatched IoT install base makes this a genuine remediation priority despite the moderate CVSS score.

An attacker with a valid low-privilege account on the GL-MT3000 management interface (or obtained through credential stuffing against a default or weak password) sends a crafted request to the iwinfo_backend function with a malicious 'device' argument such as 'wlan0; id > /tmp/out' or a reverse shell payload. The unsanitized argument is passed to an underlying system command, executing the injected payload in the router's OS context. A public proof-of-concept demonstrating this technique is available at https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/iwinfo_scan_ubus_rce, which lowers the technical barrier to exploitation significantly.