CVE-2026-11406: GL.iNet MT3000 OpenVPN Command Injection Vulnerability – Patch Guidance

Technical summary

CVE-2026-11406 is a command injection vulnerability (CWE-74, CWE-77) in the ovpnclient.sh script within GL.iNet MT3000 firmware. The OpenVPN Client Import Workflow fails to properly sanitize user-supplied configuration data before passing it to shell operations. An authenticated attacker can inject shell metacharacters into OpenVPN config parameters—such as the server address, certificate paths, or custom configuration directives—to achieve arbitrary command execution on the router. The CVSS 3.1 score of 6.3 reflects that exploitation requires prior authentication (PR:L) but carries local impact across confidentiality, integrity, and availability.

Business impact

Compromised GL.iNet MT3000 routers become entry points for lateral network movement. An attacker with administrative access (or who has socially engineered credentials) can pivot into corporate VPN infrastructure, intercept or redirect VPN traffic, install persistent backdoors, or exfiltrate sensitive data. For organizations using MT3000 as a site-to-site VPN gateway or remote access appliance, this vulnerability directly threatens the integrity of encrypted network channels and the confidentiality of data transiting those channels.

Affected systems

GL.iNet MT3000 devices running firmware version 4.4.5 and earlier are vulnerable. Verify your router's firmware version in the web interface under System > Firmware. The vulnerable component is the OpenVPN Client Import Workflow, so systems that do not use OpenVPN client functionality are not exposed to this particular code path, though updating is still recommended for defense-in-depth.

Exploitability

Exploitation is practical but gated by authentication. The attacker must have valid credentials to access the router's web interface and navigate to the OpenVPN import dialog. Public disclosure has occurred, and malicious proof-of-concept configuration files could be readily adapted by threat actors. An attacker who gains initial access via weak default credentials, phishing, or another vulnerability can immediately leverage this flaw to escalate privileges or establish persistence.

Remediation

Upgrade GL.iNet MT3000 firmware to version 4.9.0_beta3-1012-0513-1778656146 or later. The patched version implements strict validation of OpenVPN configuration files to neutralize command injection payloads. Before upgrading, back up your router configuration and test the new firmware in a non-production environment if possible. After patching, confirm the firmware version in the web interface.

Patch guidance

Access the router's web interface, navigate to System > Firmware, and check the current version. If running 4.4.5 or earlier, download the latest stable firmware from GL.iNet's official support portal. Follow the vendor's upgrade instructions carefully, as interrupted upgrades can brick the device. Do not interrupt power or network connectivity during the upgrade process. After the upgrade completes, verify that the firmware version matches the patched build and that OpenVPN client functionality operates normally.

Detection guidance

Monitor router logs for failed OpenVPN import attempts or unusual characters (backticks, pipes, semicolons, dollar signs) in OpenVPN configuration filenames or contents. Check for unexpected process spawning or elevated privilege usage following OpenVPN client import operations. Network intrusion detection systems (IDS) should flag suspicious outbound connections from the router's IP address that do not align with known VPN server endpoints. Endpoint detection and response (EDR) tools on connected systems should watch for lateral movement originating from the router's subnet immediately after import activities.

Why prioritize this

While the CVSS score is medium (6.3), this vulnerability sits in a critical trust boundary: the router controls all network traffic and authentication to internal systems. Even a medium-severity router flaw can be weaponized for persistent network compromise. The presence of public exploitation details and the straightforward attack vector (malicious config file upload) elevate practical risk. Organizations dependent on MT3000 for VPN or remote access should treat this as high-priority within their router/edge device inventory.

Risk score, explained

The CVSS 3.1 base score of 6.3 (MEDIUM) reflects: Network Attack Vector (AV:N) meaning remote exploitation is possible; Low Attack Complexity (AC:L) indicating no special conditions are needed; Low Privileges Required (PR:L) requiring valid authentication; No User Interaction (UI:N); Unchanged Scope (S:U) meaning impact is confined to the vulnerable component; and partial impact across Confidentiality, Integrity, and Availability (C:L/I:L/A:L). However, environmental context—such as whether the device is internet-facing, the value of VPN traffic it carries, or multi-factor authentication controls—can shift organizational risk higher. This score does not account for post-compromise persistence or lateral movement potential.

Frequently asked questions