CVE-2026-11448: GL.iNet GL-MT3000 Command Injection in Minidlna Service

Technical summary

CVE-2026-11448 is a command injection vulnerability (CWE-74, CWE-77) in the realpath function within the /rpc endpoint of the GL-MT3000's Minidlna service component. The flaw stems from insufficient sanitization of the 'kube.set' argument, which allows an authenticated attacker with high privileges to inject shell metacharacters. The attack vector is network-accessible and requires no user interaction. GL.iNet addressed this by implementing global injection protection mechanisms in SDK version 4.7, which intercepts and neutralizes malicious payloads before execution.

Business impact

This vulnerability affects organizations deploying GL.iNet GL-MT3000 devices as edge routers or media servers. The primary risk lies in lateral movement and network compromise by high-privilege authenticated users, such as rogue administrators or compromised admin accounts. While CVSS scoring reflects medium severity due to the authentication requirement, successful exploitation could grant attackers command execution equivalent to the device's service process privileges, potentially enabling data exfiltration or network reconnaissance from inside the protected network.

Affected systems

GL.iNet GL-MT3000 running firmware versions 4.4.5 and earlier. The Minidlna service component is the attack surface; systems without this service enabled or already running version 4.7 or later are not affected.

Exploitability

Exploitation requires valid administrative credentials to access the /rpc endpoint and construct a malicious request targeting the kube.set parameter. The barrier to entry is moderate—an attacker must already possess high-level authentication. Once authenticated, the injection payload can be delivered over the network with no additional prerequisites. The lack of CISA KEV listing suggests limited public exploitation activity as of the publication date, though the relative simplicity of command injection attacks means weaponization risk remains non-negligible.

Remediation

Upgrade GL.iNet GL-MT3000 firmware to version 4.7 or later immediately. The vendor confirms that version 4.7 includes global SDK-level injection protection. Organizations unable to upgrade immediately should restrict administrative access to trusted users only, disable remote management if not required, and monitor for suspicious /rpc calls in access logs.

Patch guidance

Apply firmware version 4.7 or later via the GL.iNet management interface or download the latest firmware from the vendor's official support portal. Verify the integrity of the firmware image using provided checksums before installation. Test the upgrade in a non-production environment if possible. Rollback procedures should be documented beforehand. Verify that the Minidlna service restarts properly post-upgrade and that no custom configurations are lost during the update process.

Detection guidance

Monitor network access logs for POST or GET requests to the /rpc endpoint with 'kube.set' parameters, particularly those containing shell metacharacters (`, $, |, &, ;, <, >, etc.). Inspect Minidlna service logs for execution of unexpected commands or unusual process spawning. On systems running firmware prior to 4.7, establish baseline behavior for administrative API calls and alert on deviations. Implement network segmentation to restrict who can reach the /rpc endpoint. Use intrusion detection signatures that flag command injection patterns in HTTP parameters.

Why prioritize this

Although CVSS scoring is medium (4.7), this vulnerability warrants prompt remediation because: (1) it affects a network-facing service, (2) command injection carries inherent risk of privilege escalation or lateral movement, and (3) administrative credentials, while required, are sometimes shared or compromised in enterprise environments. Delaying patching increases exposure window if the attack is discovered by threat actors or shared in threat intelligence feeds.

Risk score, explained

CVSS 3.1 score of 4.7 reflects the network-accessible vector (AV:N) and low complexity (AC:L) of exploitation, balanced against the requirement for high-privilege authentication (PR:H). Impact is limited to confidentiality, integrity, and availability at the device level (S:U) with low severity in each category. The score does not account for business context—organizations that centralize admin credentials or operate GL-MT3000 devices in untrusted environments should weight their risk higher.

Frequently asked questions