CVE-2026-11448: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-11448 Overview

CVE-2026-11448 is a command injection vulnerability in the GL.iNet GL-MT3000 router running firmware up to version 4.4.5. The flaw resides in the realpath function within the /rpc endpoint of the Minidlna Service component. Attackers can manipulate the kube.set argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely over the network, though it requires high privileges to trigger. GL.iNet addressed the issue in firmware version 4.7 by adding global SDK-level protection to intercept malicious injection attempts.

Critical Impact
Authenticated remote attackers can inject operating system commands through the Minidlna Service /rpc endpoint, gaining the ability to execute code on affected GL-MT3000 routers.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
Minidlna Service component (/rpc endpoint)
Devices running pre-4.7 SDK without global injection protection

Discovery Timeline

2026-06-07 - CVE-2026-11448 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11448

Vulnerability Analysis

The vulnerability is classified under [CWE-74] as an improper neutralization of special elements in output used by a downstream component. The Minidlna Service exposes a Remote Procedure Call (RPC) interface at /rpc on the GL-MT3000 router. When the realpath function processes the kube.set argument, user-controlled input flows into a system command without adequate sanitization. This allows shell metacharacters to break out of the intended command context. Successful exploitation results in arbitrary command execution within the router's operating environment.

Root Cause

The root cause is missing input validation on the kube.set parameter consumed by the realpath function. The GL.iNet SDK prior to version 4.7 lacked global protection logic to intercept injection patterns before they reached system calls. The vendor confirmed that starting with version 4.7, the SDK added centralized filtering to neutralize malicious payloads across affected endpoints.

Attack Vector

The attack is delivered over the network to the router's management interface. An attacker with valid high-privilege credentials submits a crafted RPC request to /rpc targeting the Minidlna Service. The request embeds shell metacharacters within the kube.set argument, which are passed unsanitized to realpath. The vulnerability requires no user interaction once the request is sent.

A proof-of-concept demonstrating the injection technique is published in the GitHub PoC Repository. Additional technical analysis is available in the VulDB Vulnerability Report.

Detection Methods for CVE-2026-11448

Indicators of Compromise

Unexpected outbound network connections originating from the GL-MT3000 router to unknown hosts
Modified or newly created files in the Minidlna database directory paths
Anomalous shell processes spawned by the minidlna service account
HTTP POST requests to /rpc containing shell metacharacters such as ;, |, &&, or backticks in the kube.set parameter

Detection Strategies

Inspect router access logs for RPC requests targeting the Minidlna Service with suspicious payloads in the kube.set field
Monitor for unexpected child processes of the minidlna daemon on affected firmware versions
Deploy network intrusion detection signatures that flag shell metacharacters in HTTP request bodies destined for /rpc

Monitoring Recommendations

Capture and retain router management interface logs in a centralized logging platform for retrospective analysis
Alert on configuration changes to the Minidlna service or UCI (Unified Configuration Interface) parameters outside maintenance windows
Track firmware version inventory across deployed GL.iNet devices to identify systems still running version 4.4.5 or earlier

How to Mitigate CVE-2026-11448

Immediate Actions Required

Upgrade GL.iNet GL-MT3000 firmware to version 4.7 or later, which includes the SDK-level global injection protection
Restrict access to the router's management interface to trusted administrative networks only
Rotate administrative credentials on affected devices, particularly where high-privilege access could be reused by attackers
Audit existing device configurations for unauthorized changes introduced before patching

Patch Information

GL.iNet released firmware version 4.7 to remediate CVE-2026-11448. According to the vendor, "Starting from version 4.7, SDK has added global protection to intercept malicious injection." Administrators should download the latest firmware directly from GL.iNet and verify integrity before deployment. Refer to the VulDB CVE Entry for additional remediation context.

Workarounds

Disable the Minidlna Service if media sharing functionality is not required in the deployment
Block external access to TCP ports exposing the /rpc endpoint using upstream firewall rules
Enforce network segmentation to isolate IoT routers from sensitive internal networks until patching is complete

bash

# Disable Minidlna service on GL.iNet router via SSH
/etc/init.d/minidlna stop
/etc/init.d/minidlna disable

# Verify the service is no longer running
ps | grep minidlna