Command Injection Vulnerability in GL.iNet GL-MT3000 Web Interface
CVE-2026-11450

6.9MEDIUM

Key Information:

Vendor

Gl.inet

Status
Gl-mt3000
Vendor
CVE Published:
7 June 2026

What is CVE-2026-11450?

A command injection vulnerability exists in the GL.iNet GL-MT3000, particularly in the Path Normalization Handler's dlopen function. An attacker can exploit this vulnerability by manipulating the dev_name argument, enabling remote command execution. The issue has been addressed in version 4.7, which enhances security by implementing method-level validation in the HTTP /rpc layer and removing insecure methods from the allowable list, thus blocking potential exploitation paths.

Affected Version(s)

GL-MT3000 4.4.5

GL-MT3000 4.7

References

https://vuldb.com/vuln/369070
vdb-entrytechnical-description
https://vuldb.com/vuln/369070/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11450
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

strforexc (VulDB User)
VulDB CNA Team
.