GL.iNet GL-MT3000 CVE-2026-11450

The attacker must be able to reach the GL-MT3000's oui-httpd web/RPC service on TCP (typically port 80/443 on the LAN, or the WAN side only if the user has explicitly enabled remote admin - not default). The vulnerable nas-web.eject_disk RPC method must be present in the /rpc allowed-methods whitelist, which it is on firmware 4.4.5 and earlier but not from 4.7 onward. No authentication, no user interaction, and no special account privileges are required (CVSS PR:N/UI:N), and the dev_name parameter is directly attacker-controlled. Limiting factors: the device must be running an affected firmware (4.4.5 confirmed; 4.7+ patched), and the attacker needs network reachability to the management interface - devices behind ISP NAT with no port forwarding and no malicious client on the LAN are not exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L yields 7.3 (High): network-reachable, low complexity, no privileges, no user interaction, with limited CIA impact - limited likely reflecting that oui-httpd typically runs as a constrained service rather than full root, though on consumer routers this still often equates to device takeover. Exploit Code Maturity (E:X) is unproven per the vector, but a public PoC repository (StrTzz123/iot_vul) is referenced, so publicly available exploit code exists. The CVE is not listed in CISA KEV and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. RC:C (Confirmed) and the vendor's own confirmation statement raise confidence the bug is real. Real-world risk is elevated for any GL-MT3000 with its web/RPC interface exposed to untrusted networks (LAN guest segments, WAN if remote admin enabled, or tethered/captive networks the router connects to), and lower for devices isolated to trusted LAN-only access.

An attacker on the same Wi-Fi network as a GL-MT3000 (or reaching it across the WAN if the admin interface is exposed) sends an unauthenticated HTTP POST to the /rpc endpoint invoking nas-web.eject_disk with a crafted dev_name containing shell metacharacters such as ; or backticks. The injected command is concatenated into the dlopen-adjacent path handling routine and executed by the oui-httpd process, giving the attacker arbitrary command execution on the router. A working proof-of-concept is published in the StrTzz123/iot_vul GitHub repository, lowering the bar to exploitation.