Is there a patch available for CVE-2026-11449?

Yes, a patch is available for CVE-2026-11449. Update the affected software to the latest version immediately.

GL.iNet GL-MT3000 CVE-2026-11449

Q: What is the CVSS score of CVE-2026-11449?

CVE-2026-11449 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-34980 MEDIUM

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-w9mf-f5g7-vfhw

Command Injection Gl Mt3000

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 07, 2026 - 03:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 02:57 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc_sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version 4.8.1 is sufficient to resolve this issue. Upgrading the affected component is advised. The vendor confirms: "The issue discovered by the vulnerability researcher on older firmware versions(4.4.5) has actually been fixed and mitigated in the new version. According to the latest firmware fixes, by default, firmware versions after 4.7.13 do not install LuCI, so this vulnerability cannot be exploited."

AnalysisAI

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows a remote, low-privileged attacker to execute arbitrary OS commands via the rpc_sys function exposed through the LuCI JSON-RPC interface at /cgi-bin/luci/rpc. The vendor has confirmed the vulnerability and released a fix in firmware 4.8.1; critically, versions after 4.7.13 no longer install LuCI by default, eliminating the attack surface for most current deployments. Publicly available exploit code exists in a GitHub repository, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The GL-MT3000 is a compact travel router running GL.iNet's OpenWrt-based firmware. LuCI is the standard OpenWrt web management interface and exposes a JSON-RPC API endpoint at /cgi-bin/luci/rpc for programmatic device administration. The rpc_sys function within this interface fails to properly neutralize user-supplied input before passing it to underlying system commands, constituting CWE-77 (Improper Neutralization of Special Elements used in a Command). This class of flaw allows injection of shell metacharacters or command separators into API parameters, redirecting execution flow to attacker-controlled OS commands. The CPE string cpe:2.3:a:gl.inet:gl-mt3000:*:*:*:*:*:*:*:* identifies the affected product as GL.iNet's GL-MT3000 firmware application. The CVSS temporal metric Remediation Level is set to Official Fix (RL:O) and Report Confidence is Confirmed (RC:C), indicating both vendor acknowledgment and patch availability.

RemediationAI

The primary fix is to upgrade GL-MT3000 firmware to version 4.8.1 or later, available at https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar. The vendor confirms that firmware versions after 4.7.13 address the vulnerability both by patching the flaw and by not installing LuCI by default, which eliminates the entire attack surface. For devices that cannot be immediately upgraded, the most effective compensating control is to uninstall the LuCI package via opkg remove luci, with the trade-off of losing the web-based management interface entirely. If LuCI must remain installed, restrict network access to the /cgi-bin/luci/rpc endpoint using firewall rules (iptables or nftables) to allow only trusted management IP ranges, accepting the operational trade-off of reduced remote management flexibility. Under no circumstances should the router's web management interface be exposed to untrusted or public networks while running affected firmware.