Which versions of GL.iNet GL-MT3000 are affected by CVE-2026-11452?

A command injection vulnerability in GL.iNet GL-MT3000 routers (CVE-2026-11452) could allow remote attackers to gain control of affected network devices, potentially compromising organizational…

How to fix or mitigate CVE-2026-11452?

24 hours: Inventory all GL-MT3000 routers, document firmware versions and network role/criticality; assign incident response ownership. 7 days: Implement firewall rules restricting administrative access; establish monitoring for suspicious access to affected devices; contact GL.iNet regarding patch timeline. 30 days: Deploy patches upon vendor release; if unavailable by day 30, execute remediation plan including device isolation or replacement based on network role criticality.

GL.iNet GL-MT3000 CVE-2026-11452

Q: What is the CVSS score of CVE-2026-11452?

CVE-2026-11452 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-34983 MEDIUM

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-5qf6-3rw8-7jgg

Command Injection Gl Mt3000

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 04:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 04:12 vuln.today

DescriptionCVE.org

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " The current code escapes single quotes in the password parameter and handles it inside a shell single‑quote context. The payloads in the report, which rely on $() or backticks to trigger command substitution, are not executed under the current code path. We tested on a GL‑MT3000 device running firmware 4.8.1 using similar payloads, and no command‑execution marker file was created."

AnalysisAI

Command injection in GL.iNet GL-MT3000 routers running firmware up to 4.4.5 allows remote attackers to inject shell commands through the Password argument of the SET_USER_PWD handler in /cgi-bin/glc (function FUN_0042e200). The flaw is network-reachable with low complexity, but no public exploit is identified at time of analysis and the vendor disputes practical exploitability, stating that single-quote escaping in the shell context blocks the reported $() and backtick payloads.

Technical ContextAI

The GL-MT3000 is a travel/IoT router built on OpenWrt-derived firmware exposing a CGI-based management interface at /cgi-bin/glc. The vulnerable routine FUN_0042e200 implements the SET_USER_PWD handler, which passes the user-supplied Password argument into a shell context to update credentials. Classified as CWE-77 (Improper Neutralization of Special Elements used in a Command, i.e. Command Injection), the root cause class involves user input being concatenated into a shell command without complete metacharacter sanitization. The vendor asserts that single quotes are escaped and the value is wrapped in single-quote context, which would defeat command-substitution payloads using $() or backticks but does not necessarily preclude all injection primitives depending on the exact escaping implementation.

RemediationAI

Vendor-released patch: upgrade GL-MT3000 firmware to version 4.8.1 or later, which the vendor confirms is not exploitable by the reported $()/backtick payloads. Apply the firmware update through the GL.iNet admin UI or by downloading the image from https://dl.gl-inet.com (verify checksum) and rebooting; full details are tracked at https://vuldb.com/vuln/369072. As compensating controls until patching, restrict access to the web admin interface (default port 80/443) to the trusted LAN only and disable any WAN-side or remote-management exposure of /cgi-bin/glc - the trade-off is loss of remote administration via GoodCloud or direct public access. Additionally, ensure the admin password is strong and avoid leaving the device on factory defaults, since exploitation requires reaching the SET_USER_PWD endpoint; note that strong passwords do not by themselves mitigate this issue because the injection is in the password-setting flow rather than authentication.