GL.iNet GL-MT3000 CVE-2026-12187

Requires network reachability to the GL-MT3000 web management interface (LAN by default, but frequently exposed via WAN admin, GoodCloud remote management, or Tailscale/WireGuard overlays) and valid credentials for an account with permission to invoke the Online Firmware Upgrade Handler - the CVSS PR:L indicates an authenticated low-privileged operator session is necessary, so it is not a pre-auth bug. Exploitation is limited to firmware versions up to 4.4.5 on the GL-MT3000 hardware specifically; no user interaction, no special client, and no non-default configuration beyond admin reachability is required, and AC:L/AT:N indicate no race condition or environmental prerequisite.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with E:P yields 7.4 (High) and is internally consistent with a post-auth command injection on a network-exposed admin endpoint: full triad impact on the device, no user interaction, low attack complexity, but PR:L because a valid admin/operator session on the router UI is required. Publicly available exploit code on GitHub materially lowers the skill barrier, and although no EPSS score, SSVC decision, or CISA KEV entry was provided in the input, command-injection bugs on consumer/SMB router admin panels are routinely picked up by botnet operators once a PoC ships. The main mitigating factors are the PR:L requirement and the fact that GL.iNet admin UIs are typically LAN-only by default; the main aggravating factor is that many GL-MT3000 owners deliberately expose the UI to the WAN or to Tailscale/WireGuard overlays, which neutralizes that protection. Treat as a priority patch for any fleet where these routers carry remote management or are operated by less technical users who may reuse weak admin passwords.

An attacker who has obtained or guessed the GL-MT3000 admin password (or who reaches an exposed admin panel on the WAN) authenticates to the web UI and triggers the online firmware upgrade flow with a crafted URL/version parameter containing shell metacharacters. The /usr/bin/one_click_upgrade handler concatenates the value into a shell command, executing the attacker's payload as the router's privileged service account, yielding persistent device takeover, traffic interception, and a pivot into the LAN. A working PoC for firmware 4.4.5 is published at https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/upgrade_online_url.