Which versions of GL.iNet GL-MT3000 are affected by CVE-2026-11450?

GL.iNet GL-MT3000 routers running firmware 4.4.5 contain a command injection vulnerability enabling unauthenticated remote attackers to execute arbitrary OS commands on the router.

How to fix or mitigate CVE-2026-11450?

Within 24 hours: Audit network inventory to identify all GL-MT3000 devices and confirm firmware version 4.4.5 deployment. Within 7 days: Restrict external network access to these routers and disable the nas-web RPC service if operationally feasible; implement firewall rules to limit administrative access to trusted networks only. Within 30 days: Contact GL.iNet support for available firmware updates beyond 4.4.5; if updates are released, execute patching on a change-management schedule; if no updates are available, evaluate replacing devices or maintaining permanent network segmentation.

GL.iNet GL-MT3000 CVE-2026-11450

Q: What is the CVSS score of CVE-2026-11450?

CVE-2026-11450 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-34981 MEDIUM

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-jqrf-6qhf-8j4m

Command Injection Gl Mt3000

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 03:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 02:57 vuln.today

DescriptionCVE.org

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component. The vendor confirms: " From version 4.7 onward, we have enabled method‑level validation at the HTTP /rpc layer. nas‑web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report."

AnalysisAI

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to execute arbitrary OS commands by manipulating the dev_name argument passed to the dlopen function in the /usr/lib/oui-httpd/rpc/ Path Normalization Handler, reachable via the nas-web.eject_disk RPC method. Publicly available exploit code exists on GitHub demonstrating the chain. No CISA KEV listing and EPSS data was not provided, but the network-reachable, no-authentication CVSS vector combined with public PoC makes this a meaningful risk for exposed devices.

Technical ContextAI

The GL.iNet GL-MT3000 (Beryl AX) is a consumer/SOHO travel router running OpenWrt-derived firmware. The vulnerable code path lives in the oui-httpd JSON-RPC service at /usr/lib/oui-httpd/rpc/, which exposes Lua/C handlers including the nas-web module's eject_disk function. That handler passes the user-supplied dev_name parameter into a dlopen-related path normalization routine without sufficient sanitization, allowing shell metacharacters to break out of the intended argument context. The root cause maps to CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic command-injection weakness common in router web/RPC interfaces that shell out to system utilities.

RemediationAI

Vendor-released patch: upgrade GL-MT3000 firmware to version 4.7 or later, which removes nas-web.eject_disk from the /rpc method whitelist so the vulnerable code path can no longer be reached by remote callers (per the vendor statement). Until 4.7 can be applied, disable any remote/WAN administration on the device, restrict access to the LuCI/oui-httpd web and /rpc endpoints to a trusted management VLAN or specific source IPs via firewall rules, and disconnect or do not attach USB storage if the eject_disk workflow is not in use - note that locking down /rpc will also disable legitimate web-UI features that depend on it, and disabling USB attachment removes NAS/share functionality. Monitor http access logs on the router for unexpected POSTs to /rpc invoking nas-web.eject_disk. Advisory tracking: https://vuldb.com/vuln/369070.