CVE-2026-11451
HighCVSS 7.3Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
In the GL.iNet GL-MT3000 device with firmware version 4.4.5, a command injection vulnerability was found in the snprintf function of the file /cgi-bin/glc in the FTP Protocol Handler component. Manipulating the media_dir argument can lead to command injection. The attack can be launched remotely. The vendor states that in version 4.8.1, single quotes are escaped, preventing the reported attack vectors.
Risk Assessment
The organization is at risk of remote code execution on the GL.iNet device, potentially leading to device compromise and network access.
Recommendation
Update the firmware of the GL.iNet GL-MT3000 device to version 4.8.1 or later.
Other vulnerabilities in GL.iNet GL-MT3000
See all- CVE-2026-18686Critical
A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the nas-web.add_user function in the /cgi-bin/glc file of the nas-web RPC Wrapper component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is public and may be used.
- CVE-2026-18685Critical
A security vulnerability has been detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the set_upgrade function in the /cgi-bin/glc file of the modem.so component. Such manipulation leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-18684Critical
GL.iNet GL-MT3000 router up to version 4.4.5 contains a command injection vulnerability in the remove_profile function in /cgi-bin/glc of the modem.so component. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-18616Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the server.set_peer function of /cgi-bin/glc in the wg-server.so component. Manipulating the public_key argument allows remote command execution.
- CVE-2026-18615Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the wg-server.generate_publickey function of /cgi-bin/glc in the wg-server.so component. Manipulating the private_key argument allows remote command execution.
- CVE-2026-18614Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the s2s.enable_echo_server function of /cgi-bin/glc in the s2s.so component. Manipulating the port argument allows remote command execution.
- CVE-2026-18613Critical
GL-iNet GL-MT3000 up to version 4.4.5 has an injection vulnerability in the plugins.set_config function of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote code execution.
- CVE-2026-18612Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the plugins.remove_package and plugins.install_package functions of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote command execution.
- CVE-2026-18602Critical
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- CVE-2026-18601Critical
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Original NVD description (English source)
A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version 4.8.1, before writing media_dir to the FTP configuration command, the code escapes single quotes using escape_single_quote(). The payloads in the report—which rely on closing a single quote, appending commands with a semicolon, and commenting out the tail with #—cannot escape execution under the current code path. We also verified this on a GL‑MT3000 device running firmware version 4.8.1 using similar payloads calling the /NAS_API_SET_PROTO_CONFIG interface. Although the interface returned success, the marker file intended to prove command execution was not created; the payload was written into /etc/vsftpd.conf only as ordinary configuration content and did not trigger any shell command execution. Therefore, with the current firmware version and default runtime environment, we could not reproduce the claimed “unauthorized command injection in set_proto_config”."