Which versions of GL.iNet GL-MT3000 are affected by EUVD-2026-36665?

GL.iNet GL-MT3000 travel routers used by remote workers and traveling executives are vulnerable to a high-severity security flaw that allows attackers with valid credentials to compromise the device…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-36665?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36665. Prioritise patching immediately. EPSS: 2.0%.

How to fix or mitigate EUVD-2026-36665?

Within 24 hours: Identify all GL.iNet GL-MT3000 travel routers deployed across the organization and document current firmware versions. Within 7 days: Apply patch available per vendor advisory to all GL-MT3000 units. Within 30 days: Review network and access logs for any suspicious activity that may indicate unauthorized access through vulnerable routers prior to patching.

GL.iNet GL-MT3000 EUVD-2026-36665

Q: What is the CVSS score of EUVD-2026-36665?

EUVD-2026-36665 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.0%.

| CVE-2026-12186 HIGH

Command Injection (CWE-77)

2026-06-14 VulDB

GHSA-8x52-x2jf-947x

Command Injection Gl Mt3000

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable admin RPC (AV:N), trivial injection with public PoC (AC:L), requires valid admin session (PR:L), no user interaction, root command execution gives full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 14, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 14, 2026 - 21:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 14, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jun 14, 2026 - 21:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 14, 2026 - 21:12 vuln.today

DescriptionCVE.org

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Authenticated command injection in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5) lets remote attackers with low-privileged access execute arbitrary OS commands via the replace_country function in the Tor Proxy Service configuration handler. Publicly available exploit code exists for the flaw, and the vendor has shipped a fix; no public exploit identified at time of analysis as actively exploited in the wild.

Technical ContextAI

The GL-MT3000 (Beryl AX) is a MediaTek-based pocket-sized OpenWrt-derived travel router from GL.iNet that exposes a custom JSON-RPC management interface implemented by /usr/lib/oui-httpd, the in-house HTTP daemon used across the GL.iNet firmware family. The vulnerable replace_country routine lives in the rpc/tor module, which configures Tor proxy parameters such as the country/exit-node selector. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the handler concatenates an attacker-supplied country value into a shell command (likely a system()/popen() call updating torrc or invoking iptables/iwconfig style helpers) without sanitization or argument-array execution, allowing metacharacters such as ;, |, $(...) or backticks to escape the intended command. Confirmed affected CPE: cpe:2.3:a:gl.inet:gl-mt3000.

RemediationAI

Vendor-released patch: upgrade GL-MT3000 firmware to version 4.7 or later (the vendor-published fixed image referenced in the advisory is mt3000-4.8.1-0819, available at https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar). Apply via the LuCI/GL.iNet admin UI or sysupgrade and verify the running version afterwards. As compensating controls until patching is possible, restrict access to the admin web interface to trusted management VLANs only and disable WAN-side administration in the GL.iNet UI (Settings → Admin Panel → Remote Access) to remove network reachability of the oui-httpd RPC; rotate the admin password to a strong unique value since exploitation needs PR:L; and disable the Tor client/Tor Proxy feature under Applications → Tor if not in use, which removes the reachable replace_country RPC path at the cost of losing Tor-based egress. Note that disabling remote admin will also block legitimate remote management workflows. Refer to https://vuldb.com/vuln/370832 and the PoC at https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/tor_set_config/Readme.md for indicators.