CVE-2026-11406: GL.iNet MT3000 RCE Vulnerability

CVE-2026-11406 Overview

CVE-2026-11406 is a command injection vulnerability in GL.iNet MT3000 routers running firmware up to version 4.4.5. The flaw resides in the ovpnclient.sh script within the OpenVPN Client Import Workflow component. An authenticated remote attacker can inject operating system commands through a crafted OpenVPN configuration file. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. GL.iNet resolved the issue in firmware 4.9.0_beta3-1012-0513-1778656146 by adding validation checks on OpenVPN configuration files. The weakness is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
A remote, low-privileged attacker can execute arbitrary shell commands on the router by uploading a malicious OpenVPN configuration file, compromising the device and any network traffic traversing it.

Affected Products

GL.iNet MT3000 firmware versions up to and including 4.4.5
OpenVPN Client Import Workflow component (ovpnclient.sh)
Fixed in firmware 4.9.0_beta3-1012-0513-1778656146

Discovery Timeline

2026-06-06 - CVE-2026-11406 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11406

Vulnerability Analysis

The vulnerability exists in the ovpnclient.sh shell script that processes uploaded OpenVPN client configuration files on the MT3000 router. The script fails to neutralize special shell metacharacters embedded inside configuration file fields before passing them to a downstream shell context. When the router parses a malicious .ovpn file during the import workflow, attacker-controlled content is interpreted as commands rather than configuration data. Successful exploitation grants the attacker the ability to run arbitrary shell commands within the context of the router's web management process. The weakness is classified under CWE-74, covering injection flaws caused by improper output neutralization.

Root Cause

The root cause is missing input validation and sanitization in ovpnclient.sh. The script handles OpenVPN configuration directives as trusted input, embedding them directly into shell commands without quoting or escaping. Any value containing shell metacharacters such as backticks, $(), semicolons, or pipes is interpreted by the shell interpreter. GL.iNet's fix introduces explicit checks on OpenVPN configuration files to reject malicious patterns before they reach the shell.

Attack Vector

Exploitation requires network access to the router's management interface and a low-privileged authenticated session. The attacker uploads a crafted OpenVPN .ovpn profile through the client import feature. When the router processes the profile, the embedded shell payload executes. Because the MT3000 is a network gateway, post-exploitation enables persistent backdoors, credential theft from passing traffic, and pivoting into connected LAN segments. Technical details and a proof of concept are available in the GitHub IoT Vulnerability Repo and on the VulDB advisory page.

The vulnerability manifests when configuration directive values inside the uploaded .ovpn file are concatenated into shell command strings executed by ovpnclient.sh. See the linked references above for the exact payload structure used in the public proof of concept.

Detection Methods for CVE-2026-11406

Indicators of Compromise

Unexpected child processes spawned by the router's web service or by ovpnclient.sh, particularly shells such as sh, ash, or utilities like wget, curl, nc, and busybox.
New or unrecognized OpenVPN client profiles appearing in /etc/openvpn/ or the GL.iNet client configuration directory.
Outbound connections from the router itself to attacker infrastructure shortly after a configuration import event.
Unexpected modifications to /etc/passwd, /etc/rc.local, or cron entries on the device.

Detection Strategies

Inspect .ovpn files for suspicious shell metacharacters in directive values, including backticks, $(), ;, |, and &&.
Audit router system logs for ovpnclient.sh invocations correlated with the import endpoint of the LuCI/admin web UI.
Compare firmware version against the fixed release 4.9.0_beta3-1012-0513-1778656146 across MT3000 fleet inventory.

Monitoring Recommendations

Forward router syslog data to a centralized logging or SIEM platform to retain evidence of configuration import activity.
Alert on any administrative authentication followed by OpenVPN profile uploads from unfamiliar source addresses.
Monitor egress traffic from the router's management plane for unexpected outbound shells or downloads.

How to Mitigate CVE-2026-11406

Immediate Actions Required

Upgrade affected MT3000 devices to firmware 4.9.0_beta3-1012-0513-1778656146 or later, available from GL.iNet Firmware Beta.
Restrict access to the router's administrative interface so it is not reachable from untrusted networks or the WAN.
Rotate administrative credentials on devices that may have been exposed to untrusted users prior to patching.
Review existing OpenVPN client profiles on each device and remove any unrecognized entries.

Patch Information

GL.iNet released firmware 4.9.0_beta3-1012-0513-1778656146 to address CVE-2026-11406. According to the vendor: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files." Administrators should validate the firmware image against the vendor-provided URL before flashing and reboot the device to complete the upgrade.

Workarounds

Limit OpenVPN profile import capability to trusted administrators only and disable shared admin accounts.
Block management plane access from the WAN interface using firewall rules until the firmware upgrade is applied.
Manually inspect any .ovpn file before importing it, rejecting profiles that contain shell metacharacters in directive values.

bash

# Example: scan an OpenVPN config for suspicious shell metacharacters before import
grep -nE '[`$;|&]|\$\(' /path/to/client.ovpn && echo 'REJECT: suspicious metacharacters present'