CVE-2026-11447: GL.iNet GL-MT3000 Command Injection Vulnerability

Technical summary

CVE-2026-11447 is a command injection vulnerability (CWE-74, CWE-77) in the iwinfo_backend function of GL.iNet GL-MT3000 firmware. The vulnerability stems from insufficient input validation on the device argument, permitting OS command injection. The affected component is the MTK Backend library (iwinfo.so). Remote exploitation requires authentication (CVSS vector indicates PR:L), making this accessible to any user with valid login credentials. The vendor's mitigation in version 4.7 implements global injection interception at the SDK level.

Business impact

Organizations deploying GL-MT3000 routers as network infrastructure or edge devices face risk of unauthorized command execution. While authentication is required, compromised user credentials—common in many environments—enable attackers to execute arbitrary commands with router-level privileges. This could lead to lateral movement, data exfiltration, or network disruption. The public exploit availability elevates risk for organizations that have not yet patched.

Affected systems

GL.iNet GL-MT3000 routers running firmware version 4.4.5 and earlier versions are affected. The vulnerability resides in the MTK Backend component bundled with the device firmware. Organizations should inventory deployed GL-MT3000 units and verify current firmware versions.

Exploitability

This vulnerability has moderate exploitability. Public exploits are available, lowering the technical barrier to attack. However, the CVSS vector (PR:L) indicates authentication is required—an attacker must possess valid user credentials. Network accessibility is unrestricted (AV:N). The attack complexity is low (AC:L), meaning no special conditions or timing are required once authenticated.

Remediation

Upgrade GL-MT3000 firmware to version 4.7 or later, which includes SDK-level protections against injection attacks. Verify upgrade completion by confirming firmware version in device settings. Additionally, enforce strong authentication controls: limit the number of user accounts with device access, apply strong password policies, and monitor for suspicious login activity.

Patch guidance

Download the latest firmware (version 4.7 or newer) from GL.iNet's official support portal. Back up your current configuration before upgrading. Follow the vendor's documented firmware update procedure. After upgrade, verify the new firmware version is active and confirm device functionality. For organizations with multiple GL-MT3000 units, stagger deployments to ensure network continuity.

Detection guidance

Monitor GL-MT3000 device logs for unusual command execution or system calls from authenticated sessions. Look for suspicious arguments passed to the device parameter in the iwinfo_backend function—specifically unusual shell metacharacters (|, ;, &, $(), backticks). Network intrusion detection systems should flag payloads containing shell command separators directed at the router. Verify firmware version on deployed devices using the web admin interface or SSH access to confirm patching status.

Why prioritize this

Although classified as MEDIUM severity (CVSS 6.3), this vulnerability warrants prompt attention due to three factors: (1) public exploit availability eliminates the requirement for advanced attacker capability; (2) command injection allows complete device compromise when authenticated; (3) routers are often overlooked in patch management processes, leaving organizations exposed longer than other infrastructure. Prioritize patching for GL-MT3000 units in production networks.

Risk score, explained

The CVSS 6.3 MEDIUM score reflects: low attack complexity (AC:L), network-based access (AV:N), low integrity/confidentiality/availability impact (C:L/I:L/A:L), and requirement for authentication (PR:L). However, the score does not account for the public exploit availability or the typical role of routers as trust boundaries. Consider elevation in your internal risk model if GL-MT3000 units manage sensitive network segments.

Frequently asked questions