Is there a public PoC exploit available for CVE-2026-11447?

Yes, a public proof-of-concept exploit is available for CVE-2026-11447. Prioritise patching immediately. EPSS: 0.9%.

GL.iNet GL-MT3000 CVE-2026-11447

Q: What is the CVSS score of CVE-2026-11447?

CVE-2026-11447 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-34978 LOW

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-qj6h-qcgm-wwg7

Command Injection Gl Mt3000

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 07, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 07, 2026 - 01:56 vuln.today

DescriptionCVE.org

A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 4.7 is recommended to address this issue. Upgrading the affected component is recommended. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

AnalysisAI

Command injection in GL.iNet GL-MT3000 router firmware (versions up to 4.4.5) allows a low-privileged remote attacker to execute arbitrary OS commands by manipulating the 'device' argument passed to the iwinfo_backend function in iwinfo.so. A public proof-of-concept exploit is available on GitHub, raising the realistic likelihood of opportunistic abuse. The vendor has confirmed the issue and released firmware 4.7 with a global injection interception protection in the SDK.

Technical ContextAI

The vulnerability resides in iwinfo.so, the shared library implementing the MTK (MediaTek) WiFi backend on GL.iNet GL-MT3000 consumer routers, identified via CPE cpe:2.3:a:gl.inet:gl-mt3000:*:*:*:*:*:*:*:*. The iwinfo_backend function accepts a 'device' argument - likely a network interface name - which is passed to an underlying shell command or system call without adequate sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes this root cause: attacker-controlled input containing shell metacharacters (e.g., semicolons, pipes, backticks) is interpreted by a command interpreter, enabling injection of arbitrary commands. This pattern is common in embedded router firmware where C or Lua glue code invokes shell utilities. The CVSS temporal modifiers E:P (proof-of-concept) and RL:O (official fix) and RC:C (confirmed) indicate the vulnerability is vendor-confirmed with a public POC and a released remediation.

RemediationAI

The primary remediation is to upgrade GL-MT3000 firmware to version 4.7 or later, which introduces a global injection protection layer in the SDK - confirmed directly by the GL.iNet vendor. Firmware updates can typically be applied via the router's web administration interface under the firmware upgrade section. The official fix reference is the VulDB advisory at https://vuldb.com/vuln/369067. If immediate upgrade is not possible, the following compensating controls reduce exposure: restrict access to the router's management interface (LuCI/SSH/ubus) to trusted IP addresses only using the firewall ACL settings, disable remote management if not required (this removes the network attack vector), and enforce strong credentials on all low-privilege accounts to raise the bar for PR:L exploitation. Note that IP-based restrictions only limit exposure - they do not eliminate the vulnerability in the iwinfo_backend function itself, and attackers with existing network access or via SSRF may still reach the interface.