GL.iNet GL-MT3000 EUVD-2026-34982

Exploitation requires network reach to the GL-MT3000 web management interface on firmware 4.4.5 and the ability to invoke the /cgi-bin/glc handler that processes the NAS FTP protocol configuration (the /NAS_API_SET_PROTO_CONFIG path) with an attacker-controlled media_dir parameter. The CVSS vector indicates no authentication or user interaction is required (PR:N/UI:N), but practical reach is limited by router topology: the admin/NAS interface is typically bound to the LAN/Wi-Fi side, so an attacker generally needs to be a connected client (legitimate guest, rogue Wi-Fi user, or someone who has obtained Wi-Fi credentials), unless the operator has explicitly exposed admin or cloud management to the WAN. Successful exploitation depends on the device running unpatched firmware 4.4.5 with NAS/FTP functionality reachable - on 4.8.1 the vendor states the same payload class is neutralized by escape_single_quote().

CVSS 7.3 reflects an unauthenticated network attack vector with low complexity and partial impact across confidentiality, integrity, and availability, which is consistent with command injection on a router's web management interface. Publicly available exploit code raises practical exploitability, but the CVE is not listed in CISA KEV and no EPSS score was supplied in the source data, so widespread mass exploitation is not confirmed. A meaningful conflict exists between researcher and vendor: the GitHub PoC demonstrates injection on 4.4.5, while the vendor reports it could not reproduce shell execution on 4.8.1 - and notably did not affirmatively confirm exploitation on 4.4.5 in the disclosed text, only that the patched build mitigates the documented payloads. Real-world risk is moderate and concentrated on devices whose web/NAS interface is reachable from untrusted networks (e.g., exposed admin UI, hostile Wi-Fi clients of a travel router); internet-exposed management would substantially increase risk.

An attacker on the same LAN as a GL-MT3000 running 4.4.5 - for example, a guest connected to a travel router in a hotel room or coffee shop - sends an HTTP request to /cgi-bin/glc invoking the NAS FTP configuration interface with a media_dir value that closes a single quote, appends a shell command separated by a semicolon, and comments out the trailing quote with #. Because publicly available exploit code exists, this can be automated with minimal effort, and successful injection yields command execution in the FTP configuration write context on the router, potentially enabling pivoting onto the LAN and tampering with router state.