GL.iNet GL-MT3000 CVE-2026-12186

Exploitation requires (1) network reachability to the oui-httpd management interface on the GL-MT3000 - by default this is exposed on the LAN side (192.168.8.1) and is only reachable from the WAN if the user enabled Remote Access in the admin panel; (2) a valid authenticated session against the admin RPC endpoint (CVSS PR:L), meaning the attacker must possess or obtain the device admin password (default, weak, phished, or CSRF-chained); (3) the device must be running firmware ≤ 4.4.5 with the Tor Proxy Service handler /usr/lib/oui-httpd/rpc/tor present (this RPC ships in stock firmware so no opt-in feature toggle is required). No user interaction is needed once authenticated, and no specific platform exception applies beyond the GL-MT3000 (Beryl AX) hardware identified in the CPE.

Real-world risk is moderate-to-high but bounded. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) accurately reflects that exploitation is network-reachable, low-complexity, requires no user interaction, and yields full compromise of the device - but it requires PR:L, meaning a valid authenticated session against the oui-httpd RPC endpoint. Combined with a publicly available PoC on GitHub and confirmed vendor patch, this is a credible weaponization candidate for opportunistic attackers on LAN-exposed or WAN-exposed admin interfaces, especially given that many travel-router users retain default/weak admin credentials. There is no CISA KEV listing and no EPSS score provided, so widespread mass exploitation is not yet evidenced; the dominant risk profile is post-credential-compromise lateral abuse and attackers chaining default-credential or CSRF-style flows to reach PR:L. No conflicting signals were observed between the vector and the description.

An attacker on the same LAN as a GL-MT3000 (or reaching it over WAN where remote admin is enabled) authenticates to the web UI using a weak, default, or phished admin credential, then issues a crafted JSON-RPC call to the tor module's replace_country method with shell metacharacters embedded in the country parameter. The oui-httpd handler concatenates the value into a shell command and executes the attacker's payload as root, allowing them to install a persistent implant, exfiltrate VPN/WireGuard credentials stored on the device, or pivot to the internal network behind the router. A working PoC is published on GitHub (StrTzz123/iot_vul), lowering the skill barrier substantially.