CVE-2026-11449: GL.iNet GL-MT3000 Command Injection in LuCI JSON-RPC Interface

Technical summary

CVE-2026-11449 is a command injection flaw in the rpc_sys function of the LuCI JSON-RPC interface (/cgi-bin/luci/rpc) in GL-MT3000 firmware 4.4.5. The vulnerability stems from insufficient input validation (CWE-74, CWE-77) that allows an authenticated remote attacker to inject and execute arbitrary system commands. The CVSS v3.1 score of 6.3 reflects the requirement for valid credentials but the ability to impact confidentiality, integrity, and availability of the affected router.

Business impact

This vulnerability could allow an attacker with valid credentials to compromise router functionality, redirect traffic, modify firewall rules, or pivot to connected devices. For organizations relying on GL-MT3000 routers for network access or VPN services, exploitation could disrupt connectivity and enable further lateral movement. The threat is limited by the authentication requirement, but compromised user credentials—whether through phishing, credential reuse, or prior breaches—represent a realistic attack path.

Affected systems

GL.iNet GL-MT3000 routers running firmware version 4.4.5 and potentially other versions between the vulnerable release and the fix are affected. The vulnerability does not exist in firmware 4.8.1 and later. Additionally, firmware versions 4.7.13 and newer do not include the LuCI component by default, preventing exploitation even if earlier code is present. Organizations should verify their current firmware version via the device web interface or SSH.

Exploitability

Exploitation requires valid authentication credentials to access the LuCI JSON-RPC interface. An attacker must already possess or obtain login credentials (typically the device's admin password). No special techniques, privilege escalation within the router, or out-of-band access is needed; the vulnerability is straightforward to exploit once authenticated. The network-accessible nature of the interface makes this a practical concern for routers exposed to untrusted networks or accessible remotely.

Remediation

Upgrade GL-MT3000 firmware to version 4.8.1 or later. Alternatively, if using firmware 4.7.13 or newer, verify that LuCI is not installed, as it is excluded by default in those versions. Immediate action is recommended for any router running 4.4.5 or intermediate firmware versions. Verify the current firmware version in the device settings or via SSH (uname -a or equivalent) before upgrading.

Patch guidance

Navigate to the GL-MT3000 firmware update page (typically accessible at the router's admin interface under System > Upgrade or similar). Download firmware version 4.8.1 or the latest available release from GL.iNet's official support website. Follow the vendor's upgrade procedure carefully, avoiding interruption during the flash process. After upgrading, reboot and confirm the new version is active. For headless deployments, firmware updates may also be performed via SSH or REST API; consult GL.iNet's technical documentation for your specific setup.

Detection guidance

Identify GL-MT3000 devices on your network via NMAP scanning for typical router signatures or SSH banner grabbing (SSH will often reveal firmware details). Query devices for firmware version via SNMP if enabled, or access the web interface and check System > System Status. Monitor authentication logs on routers for failed or unusual login attempts to /cgi-bin/luci/rpc. Review firewall logs for unexpected command execution or error messages from the CGI interface. Network detection can flag suspicious patterns sent to the RPC endpoint if behavioral baselines are established.

Why prioritize this

Although the CVSS score is moderate (6.3), the vulnerability warrants prompt remediation because command injection allows full router compromise, routers are critical infrastructure, and many organizations may have GL-MT3000 units without comprehensive monitoring. The authentication requirement reduces immediate risk compared to an unauthenticated flaw, but credential compromise is common. Patching is straightforward and low-risk, making this a high-priority routine maintenance item rather than an emergency, unless the device is internet-facing or used in sensitive environments.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects: Network-accessible attack vector (AV:N), low attack complexity requiring only valid credentials (AC:L), the need for authenticated access (PR:L), no special user interaction required (UI:N), and impact on confidentiality, integrity, and availability of the device itself (C:L, I:L, A:L). The score does not account for downstream impact on connected networks or critical business functions, which may elevate organizational risk depending on deployment context.

Frequently asked questions