GL.iNet GL-MT3000 EUVD-2026-34980

Three conditions must all be true for exploitation: (1) the target device runs GL-MT3000 firmware version 4.4.5 or another version in the 4.4.5-4.7.13 range that installs LuCI by default - firmware after 4.7.13 does not install LuCI by default and is not exploitable in default configuration; (2) the LuCI package is installed and the /cgi-bin/luci/rpc endpoint is reachable from the attacker's network position; (3) the attacker holds at least low-privilege authenticated access to the LuCI interface (PR:L per CVSS vector), meaning valid credentials or a captured session token are required - unauthenticated exploitation is not supported by available data. Exploitation is specifically limited by the authentication requirement, the LuCI installation dependency, and network reachability of the management interface. The CVSS Scope is Unchanged (S:U), meaning impact is confined to the router itself and does not propagate to downstream systems directly.

The CVSS 3.1 base score of 6.3 (Medium) reflects a network-reachable attack (AV:N) with low complexity (AC:L) but a meaningful barrier in the form of required low-privilege authentication (PR:L), which limits purely opportunistic exploitation. The unchanged scope (S:U) and uniformly low impact ratings (C:L/I:L/A:L) are arguably conservative - command injection on a router commonly yields full device control beyond what these ratings suggest, though CVSS scope is bounded to the router itself. The most significant real-world risk amplifier is the publicly available PoC on GitHub, which substantially lowers the skill threshold for exploitation despite the CVSS exploit maturity field being listed as Not Defined (E:X) - this appears to be a data gap given the confirmed PoC repository. No EPSS score was provided in the available data, so exploitation probability cannot be quantified against the broader vulnerability population. This CVE is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. The vendor's statement that LuCI is not installed by default in firmware after 4.7.13 is the single most impactful risk-reduction factor: devices running current firmware are not exposed to this vulnerability regardless of patch status.

An attacker who has obtained low-privilege credentials for the GL-MT3000 web interface - through credential stuffing, default credential use, or prior access - sends a crafted HTTP POST request to /cgi-bin/luci/rpc with shell metacharacters injected into a parameter processed by the rpc_sys function, causing the router to execute attacker-controlled OS commands. A proof-of-concept is publicly available on GitHub at https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/luci_rpc_sys_exec_rce, significantly reducing the skill required for exploitation. If LuCI is exposed on a network segment accessible to the attacker, exploitation requires no user interaction and low attack complexity once authentication is satisfied.