GL.iNet GL-MT3000 CVE-2026-11452

Exploitation requires the attacker to reach the router's web management interface and invoke the SET_USER_PWD action of the /cgi-bin/glc CGI with a manipulated Password parameter - by default this interface is bound to the LAN, so internet-based exploitation requires the operator to have explicitly enabled WAN-side admin access or remote management. No user interaction or prior authentication is indicated by the CVSS vector (UI:N, PR:N), meaning a network-adjacent attacker can attempt the request without credentials. Exploitation is limited by the vendor's escaping of single quotes within a single-quote shell context, which according to the vendor blocks $()- and backtick-based command substitution; successful exploitation therefore depends on identifying an injection primitive not covered by that escaping, and is constrained to firmware versions up to 4.4.5 on the GL-MT3000 hardware specifically.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a remotely reachable, unauthenticated, low-complexity attack with low impact across CIA - a profile typical of network-facing CGI command injection. However, several signals temper the urgency: this CVE is not listed in CISA KEV, no EPSS score was supplied in the intelligence package, no public exploit is identified at time of analysis, and the vendor has publicly disputed exploitability after testing the reported payloads on the patched 4.8.1 firmware. The SSVC framework would likely score this as not actively exploited with uncertain automatability given the disputed PoC. There is a conflict between the network attack vector and the realistic exposure profile: GL.iNet management interfaces are typically LAN-only by default, so 'AV:N' assumes the user has exposed the admin UI to a reachable network - a deployment that is common for remote-managed travel routers but not universal. Treat as a moderate-priority patching item rather than an emergency, but verify whether the disputed-payload claim covers all injection primitives, not just $()/backticks.

An attacker on the same network segment as a GL-MT3000 router (for example, a guest on a coffee-shop or co-working Wi-Fi where a travel router is in use), or anywhere on the internet if the admin interface has been exposed, sends a crafted POST request to /cgi-bin/glc invoking the SET_USER_PWD handler with a shell-metacharacter payload in the Password field. If sanitization can be bypassed, the injected command executes with the privileges of the web service (typically root on consumer routers), enabling configuration tampering, traffic interception, or persistent implant installation. A researcher PoC exists on GitHub but the vendor states the current escaping prevents the published payloads from executing.