GL.iNet GL-MT3000 CVE-2026-11448

Q: What is the CVSS score of CVE-2026-11448?

CVE-2026-11448 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-34979 MEDIUM

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-pg7m-jpvg-gp32

Command Injection Gl Mt3000

5.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 07, 2026 - 03:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 02:57 vuln.today

DescriptionCVE.org

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

AnalysisAI

Remote command injection in GL.iNet GL-MT3000 firmware versions up to 4.4.5 enables a network-reachable, high-privilege attacker to execute arbitrary OS commands through the Minidlna service's /rpc endpoint by manipulating the kube.set argument of the realpath function. The vendor has confirmed the vulnerability and released a fix in firmware version 4.7, citing SDK-level global sanitization as the remediation. Publicly available exploit code exists in a GitHub proof-of-concept repository (StrTzz123/iot_vul), though no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

The GL-MT3000 is a compact travel router manufactured by GL.iNet, running a customized OpenWrt-based firmware stack. The vulnerable component is the Minidlna media server service, which exposes functionality through the device's /rpc endpoint. The realpath function within this service processes the kube.set argument without sufficient sanitization before incorporating it into a shell command, resulting in CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The affected CPE is cpe:2.3:a:gl.inet:gl-mt3000:*:*:*:*:*:*:*:*, covering all firmware versions through 4.4.5. The root cause is classic unsanitized command construction: user-supplied data flows from the RPC argument directly into a command execution context without escaping, allowlisting, or parameterization.

RemediationAI

Upgrade GL.iNet GL-MT3000 firmware to version 4.7 or later, which the vendor has confirmed includes SDK-level global protection to intercept malicious injection across the platform. The official advisory is referenced at https://vuldb.com/vuln/369068. If immediate firmware upgrade is not feasible, administrators should apply compensating controls in order of effectiveness: disable the Minidlna media server service entirely if DLNA media sharing is not required, as this eliminates the vulnerable attack surface with the trade-off of losing media sharing functionality; restrict access to the /rpc endpoint and administrative interface to trusted internal network segments using firewall rules or ACLs, preventing remote exploitation but not protecting against internal threats; and replace default administrative credentials with strong, unique passwords to deny attackers the high-privilege access required by the PR:H vector. These mitigations reduce but do not eliminate risk - vendor-released firmware 4.7 remains the authoritative and recommended remediation.