EUVD-2026-34963
GHSA-6qr8-c78q-5fg9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."
AnalysisAI
Command injection in GL.iNet MT3000 routers running firmware up to version 4.4.5 allows authenticated remote attackers to execute arbitrary OS commands by supplying a crafted OpenVPN configuration file through the device's OpenVPN Client Import Workflow. The shell script ovpnclient.sh processes imported .ovpn files without adequately sanitizing user-controlled content, enabling embedded shell metacharacters or directives to execute at the OS level. A public proof-of-concept exploit is available on GitHub; an official vendor-released patch exists in beta firmware, and no public exploit identified at time of analysis has been confirmed by CISA KEV as actively exploited in the wild.
Technical ContextAI
The GL.iNet MT3000 is a compact travel router running a GL.iNet-customized OpenWrt-based Linux firmware. The vulnerable component is ovpnclient.sh, a shell script responsible for ingesting and processing OpenVPN client configuration files (.ovpn) during the import workflow exposed through the device's web management interface. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause class: attacker-controlled data from the imported configuration file is passed to a shell interpreter without proper escaping or allowlist validation, permitting injection of arbitrary shell commands. The CPE string cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* covers all MT3000 firmware releases through 4.4.5. The vendor explicitly confirmed the mechanism: 'malicious OpenVPN configuration files' serve as the injection carrier, indicating the trust boundary failure is at the file-ingestion stage rather than at a network protocol layer.
RemediationAI
The primary remediation is upgrading the GL.iNet MT3000 firmware to version 4.9.0_beta3-1012-0513-1778656146, available at https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar. Administrators should note this is a beta/testing firmware build - evaluate stability trade-offs before deploying in environments requiring high availability, as beta releases may introduce regressions. The vendor confirmed the fix adds malicious input validation checks on imported OpenVPN configuration files. Where immediate upgrade is not feasible, restrict access to the router's web management interface (typically TCP 80/443/8080) to trusted IP addresses only, using firewall or ACL rules - this degrades the AV:N attack vector to effectively local or VPN-only access. Additionally, disable the OpenVPN Client Import feature entirely if it is not actively in use; doing so removes the vulnerable code path at the cost of losing VPN import convenience. Enforcing strong, non-default admin credentials reduces exploitation risk given the PR:L authentication requirement.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote a
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today