Which versions of GL.iNet GL-MT3000 are affected by EUVD-2026-36666?

GL.iNet GL-MT3000 travel routers contain a remote code execution vulnerability in the firmware upgrade handler that allows authenticated attackers to execute arbitrary system commands.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-36666?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36666. Prioritise patching immediately. EPSS: 2.0%.

How to fix or mitigate EUVD-2026-36666?

Within 24 hours: Inventory all GL-MT3000 routers in production; confirm current firmware versions and whether management interfaces are internet-exposed. Within 7 days: Upgrade all affected devices to firmware version 4.7 or later (4.8.1 currently available); rotate all management credentials. Within 30 days: Restrict management access through network segmentation (VPN/internal-only); deploy network detection rules for CVE-2026-12187 exploitation attempts.

GL.iNet GL-MT3000 EUVD-2026-36666

Q: What is the CVSS score of EUVD-2026-36666?

EUVD-2026-36666 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.0%.

| CVE-2026-12187 HIGH

Command Injection (CWE-77)

2026-06-14 VulDB

GHSA-8rqp-5vg5-cv68

Command Injection Gl Mt3000

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable admin UI (AV:N), no special conditions (AC:L), authenticated low-privileged operator session required (PR:L), no user interaction, full device compromise on a single OS scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 14, 2026 - 23:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 14, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 14, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 14, 2026 - 23:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 14, 2026 - 22:42 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Command injection in the GL.iNet GL-MT3000 travel router's Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) allows authenticated remote attackers to execute arbitrary OS commands on devices running firmware up to 4.4.5. Publicly available exploit code exists on GitHub, and the issue is fixed in firmware 4.7 (with 4.8.1 currently published by the vendor). No CISA KEV listing has been confirmed, but the combination of a published PoC and an internet-exposable management interface raises the practical risk above the headline CVSS score.

Technical ContextAI

The GL-MT3000 ('Beryl AX') is a Wi‑Fi 6 travel router built on OpenWrt with a custom GL.iNet management UI that calls native binaries through a Lua/uHTTPd backend. The vulnerable component, /usr/bin/one_click_upgrade, implements the one-click online firmware upgrade workflow and is invoked from the web management API. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that user-supplied input - most likely an upgrade URL or version parameter - is concatenated into a shell command (e.g. via system()/popen()/sh -c) without proper neutralization, letting attackers break out with shell metacharacters such as ;, |, $(), or backticks. The CPE cpe:2.3:a:gl.inet:gl-mt3000:*:*:* identifies the GL-MT3000 product line as a whole rather than a single firmware build, consistent with the description that everything up to 4.4.5 is impacted.

RemediationAI

Apply the vendor-released fix by upgrading firmware to 4.7 or later; GL.iNet has published 4.8.1 at https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar, which should be preferred as the current rolled-up release. Until the upgrade is rolled out, restrict access to the router's web administration interface to trusted management VLANs or hosts, disable any WAN-side admin exposure and any remote-access overlays (Tailscale/WireGuard/GoodCloud) that publish the LuCI/GL UI, and rotate the admin password to a strong unique value to make the PR:L precondition harder to satisfy; the trade-off is loss of remote administration convenience. Avoid relying on disabling the upgrade page alone as a workaround, since the vulnerable binary may be reachable from other UI flows.