GL-iNet GL-MT3000 EUVD-2026-52395

No special conditions are required beyond network reachability of the management interface - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation with no complexity barriers against GL-MT3000 devices running firmware 4.4.5 or earlier where the /cgi-bin/glc endpoint is accessible. The principal limiting factor is network segmentation: devices whose management interface is firewalled, bound only to a local LAN interface, or accessible exclusively through a VPN are substantially protected from remote exploitation. No non-default configuration, user interaction, or authentication is required, meaning any internet-exposed device is vulnerable as deployed.

The CVSS 4.0 score of 8.9 with base metrics AV:N/AC:L/AT:N/PR:N/UI:N reflects the most dangerous exploitation profile: remotely reachable, trivially exploitable, requiring no credentials or user interaction. The E:P exploit maturity modifier confirms publicly available exploit code, corroborated by a GitHub repository linked in the references. The vulnerable system impact is assessed as High across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), consistent with arbitrary OS command execution on a router. The absence of a CISA KEV listing means active in-the-wild exploitation is not confirmed, but this is not reassuring given the availability of working exploit code and the internet-exposure typical of remote-management-enabled routers. EPSS data was not provided, limiting probabilistic forecasting. The primary real-world risk limiter is network accessibility: devices whose management interface is restricted to a local LAN or management VLAN have substantially reduced exposure. No conflicting signals between data sources were identified.

An unauthenticated attacker sends a crafted HTTP request to the /cgi-bin/glc endpoint on a GL-MT3000 with its management interface exposed to the internet, injecting shell metacharacters (e.g., semicolons or backticks) into the package name parameter consumed by plugins.install_package or plugins.remove_package. The injected payload executes as an OS command under the privileges of the router's CGI process, granting full device control - enabling persistent backdoor installation, traffic interception, or lateral movement into connected networks. A public proof-of-concept documenting the exact exploitation technique is available at https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/plugins_package_name_glc_rce/CVE.md.