CVE-2026-11452: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-11452 Overview

CVE-2026-11452 is a command injection vulnerability in the GL.iNet GL-MT3000 travel router running firmware versions up to 4.4.5. The flaw resides in the FUN_0042e200 function of the /cgi-bin/glc binary, specifically within the SET_USER_PWD handler. An unauthenticated remote attacker can manipulate the Password parameter to inject operating system commands. The vendor has released firmware version 4.8.1 to address the issue and disputes full exploitability, stating that current code escapes single quotes and contains payloads within a shell single-quote context.

Critical Impact
Remote attackers can inject commands through the password parameter of the user password handler, potentially compromising the router with confidentiality, integrity, and availability impact.

Affected Products

GL.iNet GL-MT3000 firmware up to 4.4.5
/cgi-bin/glc binary, SET_USER_PWD handler
Function FUN_0042e200

Discovery Timeline

2026-06-07 - CVE-2026-11452 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11452

Vulnerability Analysis

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). The flaw exists in FUN_0042e200, a function inside the /cgi-bin/glc CGI binary that processes the SET_USER_PWD request. When the handler receives a Password value, it passes that value into a shell command without sufficient neutralization of shell metacharacters. The router is a network-facing device, and the handler is reachable remotely without authentication based on the reported attack vector.

The public proof-of-concept demonstrates injection via the Password parameter against firmware 4.4.5. The vendor states that the current code path escapes single quotes and contains the value inside a single-quote shell context, blocking payloads relying on $() or backtick command substitution. The vendor confirmed no marker file was created when retesting equivalent payloads on firmware 4.8.1.

Root Cause

The root cause is the construction of a shell command line that incorporates user-supplied input from the Password field of the SET_USER_PWD API. The handler does not apply argument-safe execution primitives such as execve with a fixed argument vector. Instead, the parameter reaches a shell interpreter, where insufficient quoting allows attackers using firmware 4.4.5 to break out of the intended argument context.

Attack Vector

The attack is delivered over the network against the router's web management interface. An attacker submits a crafted HTTP request to /cgi-bin/glc invoking the SET_USER_PWD handler with a malicious Password value. Because the request targets a low-privilege management endpoint that ultimately executes shell commands, successful injection results in command execution in the context of the router service. The published GitHub IoT RCE PoC documents the request format and payload structure.

Detection Methods for CVE-2026-11452

Indicators of Compromise

HTTP POST requests to /cgi-bin/glc containing SET_USER_PWD with shell metacharacters such as ;, |, &, $(, or backticks in the Password field.
Unexpected child processes spawned by the router's web server or glc CGI binary.
New or modified files in writable router paths following inbound management requests.
Outbound connections from the router to unfamiliar hosts shortly after SET_USER_PWD requests.

Detection Strategies

Inspect HTTP traffic to GL-MT3000 management endpoints for SET_USER_PWD requests containing non-printable characters or shell control operators in the Password parameter.
Compare deployed firmware versions against the fixed release (4.8.1) and flag any device at 4.4.5 or earlier.
Correlate management-plane access logs with process execution telemetry on adjacent network monitoring sensors.

Monitoring Recommendations

Restrict and log access to the router's LuCI and /cgi-bin/ endpoints from management segments only.
Forward router syslog and authentication events to a central analytics platform for retrospective hunting.
Alert on configuration changes, new SSH sessions, or unexpected package installations on edge routers.

How to Mitigate CVE-2026-11452

Immediate Actions Required

Upgrade GL-MT3000 firmware to version 4.8.1 or later, which the vendor identifies as the remediated release.
Remove exposure of the router web interface to untrusted networks, including WAN-side administration.
Rotate administrative credentials on affected devices after patching.
Audit access logs for prior interactions with /cgi-bin/glc containing the SET_USER_PWD action.

Patch Information

GL.iNet has released firmware version 4.8.1 for the GL-MT3000. According to the vendor statement referenced in the VulDB CVE-2026-11452 entry, the current code escapes single quotes in the password parameter and processes it within a shell single-quote context, blocking command substitution payloads. Apply the upgrade through the device administration interface or the official GL.iNet firmware portal.

Workarounds

Disable remote administration and restrict the web interface to trusted LAN segments using firewall rules.
Place the router management interface behind a VPN gateway requiring strong authentication.
If patching is delayed, isolate affected GL-MT3000 devices on a dedicated VLAN with strict egress filtering.

bash

# Configuration example: restrict LuCI/CGI access to a management subnet
uci add firewall rule
uci set firewall.@rule[-1].name='Restrict-WebAdmin'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='REJECT'
uci commit firewall
/etc/init.d/firewall restart