CVE-2026-11406

MediumCVSS 6.3

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.23%

66th percentile - higher than 66% of all known CVEs

Summary

A vulnerability in GL.iNet MT3000 up to version 4.4.5. Unknown code in ovpnclient.sh of the OpenVPN Client Import Workflow component allows command injection. Remote attack, exploit public. Fixed in version 4.9.0_beta3-1012-0513-1778656146.

Risk Assessment

An attacker can remotely execute commands on the GL.iNet device, leading to router and network takeover.

Recommendation

Update GL.iNet MT3000 to version 4.9.0_beta3-1012-0513-1778656146 or later.

Other vulnerabilities in GL.iNet MT3000

CVE-2023-29778Critical
GL.iNET MT3000 version 4.1.0 Release 2 is vulnerable to OS command injection via the /usr/lib/oui-httpd/rpc/logread endpoint. An attacker can remotely execute arbitrary commands on the system.

Original NVD description (English source)

A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."