Which versions of GL.iNet GL-MT3000 are affected by CVE-2026-11451?

GL.iNet GL-MT3000 routers running firmware 4.4.5 can be remotely compromised without authentication by attackers armed with publicly available exploit code.

How to fix or mitigate CVE-2026-11451?

Within 24 hours: Inventory all GL-MT3000 devices and identify those running firmware 4.4.5 or earlier. Within 7 days: Upgrade all affected routers to firmware 4.8.1 or later; consider automated deployment for managed devices. Within 30 days: Verify 100% of devices have been upgraded; audit configurations to ensure remote management access is restricted or disabled.

GL.iNet GL-MT3000 CVE-2026-11451

Q: What is the CVSS score of CVE-2026-11451?

CVE-2026-11451 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-34982 MEDIUM

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-rw8j-c4m6-h6r7

Command Injection Gl Mt3000

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 04:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 04:12 vuln.today

DescriptionCVE.org

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version 4.8.1, before writing media_dir to the FTP configuration command, the code escapes single quotes using escape_single_quote(). The payloads in the report-which rely on closing a single quote, appending commands with a semicolon, and commenting out the tail with #-cannot escape execution under the current code path. We also verified this on a GL‑MT3000 device running firmware version 4.8.1 using similar payloads calling the /NAS_API_SET_PROTO_CONFIG interface. Although the interface returned success, the marker file intended to prove command execution was not created; the payload was written into /etc/vsftpd.conf only as ordinary configuration content and did not trigger any shell command execution. Therefore, with the current firmware version and default runtime environment, we could not reproduce the claimed “unauthorized command injection in set_proto_config”."

AnalysisAI

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to inject shell commands via the media_dir parameter handled by the snprintf call in /cgi-bin/glc's FTP protocol handler. The CVSS vector indicates network-reachable, unauthenticated exploitation with low complexity, and publicly available exploit code exists on GitHub (StrTzz123/iot_vul). The vendor has issued firmware 4.8.1 and disputes reproducibility on the patched build, stating that escape_single_quote() now sanitizes the input before it reaches the FTP configuration write path.

Technical ContextAI

GL.iNet GL-MT3000 (Beryl AX) is a consumer/SOHO travel router running OpenWrt-based firmware. The vulnerable code path lives in the /cgi-bin/glc CGI handler that builds an FTP (vsftpd) configuration line for NAS sharing using snprintf with the user-controlled media_dir field, then writes it to /etc/vsftpd.conf. CWE-77 (Improper Neutralization of Special Elements used in a Command) applies because the user input was concatenated into a shell-style configuration string without escaping single quotes, allowing classic quote-break, semicolon, and trailing-

techniques to inject additional commands. The CPE cpe:2.3:a:gl.inet:gl-mt3000:::::::: covers the GL-MT3000 product line. Vendor remediation introduces an escape_single_quote() routine on the media_dir input before it reaches the configuration writer.

RemediationAI

Vendor-released patch: firmware 4.8.1 - upgrade GL-MT3000 devices to 4.8.1 or later via the GL.iNet admin UI or official firmware download, which adds escape_single_quote() sanitation of media_dir before it is written into the vsftpd configuration command. As compensating controls until patching, disable the NAS/FTP sharing feature on the router (this removes the vulnerable /NAS_API_SET_PROTO_CONFIG code path at the cost of losing USB share functionality), restrict access to the LuCI/admin web interface to a trusted management VLAN or the LAN side only (which blocks WAN-side exploitation but does not protect against malicious LAN clients on a travel router), and ensure remote administration / cloud management exposure is disabled. Reference the VulDB advisory at https://vuldb.com/vuln/369071 and the public PoC at https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/nas_proto_media_dir_glc_rce/Readme.md for indicators.