GL.iNet GL-MT3000 EUVD-2026-52537

Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires only network reachability to the GL-MT3000 web management interface (typically TCP 80 or 443) with no authentication, no special configuration beyond default firmware state, and no user interaction. The specific attack surface is the set_upgrade function within /cgi-bin/glc (modem.so), which is active by default on GL-MT3000 hardware due to its integrated modem slot. The primary limiting factor is network topology: if the management interface is bound exclusively to the LAN-side interface - the default for most consumer routers - exploitation is restricted to LAN-adjacent attackers or those who have already gained LAN access. WAN-side exposure (enabled remote management, GoodCloud tunneling, or bridged network configurations) removes this topological barrier entirely. The PR:N classification is sourced solely from the VulDB-provided CVSS 4.0 vector and has not been independently corroborated by a second source; if the endpoint enforces session authentication, the effective prerequisite escalates to PR:L or PR:H.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as remotely exploitable with low complexity, no privileges required, and no user interaction - a worst-case accessibility profile. The E:P modifier (proof-of-concept exists) drives the score to 8.9; without it the base score would be higher. A CVSS 3.1 equivalent maps to approximately 9.8 (Critical). The absence of a CISA KEV listing means active widespread exploitation has not been confirmed by authoritative sources, and EPSS data was not provided in the input - exploitation probability cannot be stated with precision. However, the public PoC on GitHub (StrTzz123/iot_vul) materially lowers the skill barrier for would-be attackers, and the vendor confirmation removes ambiguity about the vulnerability's existence. The PR:N classification warrants verification: router CGI upgrade functions commonly require admin authentication, and if the endpoint actually requires a session token, real-world exploitability is reduced to authenticated LAN-side actors. Until an independent advisory or researcher confirms PR:N, treat the CVSS 4.0 vector as the authoritative but single-source assessment. For deployments where the management interface is WAN-exposed, this should be treated as a critical priority.

A remote attacker with network access to the GL-MT3000 management interface sends a crafted HTTP request to /cgi-bin/glc targeting the set_upgrade function, embedding shell metacharacters (e.g., semicolons, backticks, or $() constructs) in a parameter that modem.so passes unsanitized to a system call. On embedded OpenWrt-based devices, CGI processes typically run as root, so the injected command executes with full device privileges - enabling persistent backdoor installation, credential exfiltration, or use of the device as a network pivot. A public PoC confirming this technique is available at https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_set_upgrade_glc_rce, reducing the required attacker skill to script-kiddie level.