GL.iNet GL-MT3000 CVE-2026-11448

Exploitation requires an authenticated session with high-privilege (administrator-level) credentials on the GL-MT3000 device, as confirmed by CVSS PR:H. The Minidlna service must be running and the /rpc endpoint must be reachable by the attacker - from the local network, or from the internet if remote management or WAN-side admin access is enabled. No non-default configuration of the Minidlna service itself is required beyond it being active. The primary factor limiting exploitation is the high privilege requirement: an attacker must first acquire valid administrator credentials through default password reuse (a realistic scenario on consumer/travel routers), credential phishing, brute force, or a separate prior vulnerability. Direct unauthenticated remote exploitation is not supported by the CVSS:3.1/PR:H vector.

The CVSS 4.7 Medium score is primarily constrained by PR:H (high privileges required), meaning an attacker must already hold administrator-level credentials before exploitation - substantially narrowing the realistic threat surface despite the network-accessible attack vector (AV:N) and low attack complexity (AC:L). The vulnerability does not appear in CISA KEV, indicating no confirmed widespread active exploitation. However, a public proof-of-concept repository exists on GitHub, which meaningfully elevates risk compared to unproven CVEs - particularly for internet-exposed devices or deployments using default credentials. EPSS data is absent from the available intelligence, preventing probabilistic exploitation likelihood scoring. The CVSS remediation level RL:O and report confidence RC:C confirm this is vendor-acknowledged and officially patched. The limited scope (S:U) and low CIA impact ratings (C:L/I:L/A:L) suggest constrained access in the CVSS model, though OS-level command execution on a router has network-wide implications - such as traffic interception or lateral movement - that the unchanged scope field does not fully reflect.

An attacker who has obtained GL-MT3000 administrator credentials - through default password reuse, credential theft, or a prior compromise - sends a crafted POST request to the device's /rpc endpoint, embedding shell metacharacters in the kube.set argument processed by the Minidlna service's realpath function. The unsanitized argument is passed directly into a system command, causing the router to execute the injected payload with device-level privileges. A public proof-of-concept repository at https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/minidlna_db_dir_uci_rce demonstrates this technique against firmware 4.4.5, lowering the skill bar for exploitation.