CVE-2026-11450: GL.iNet GL-MT3000 Remote Command Injection Vulnerability

Technical summary

The vulnerability resides in the dlopen function within /usr/lib/oui-httpd/rpc/, a component responsible for handling path normalization in the GL-MT3000's web interface. The flaw involves improper sanitization of the dev_name argument passed to the RPC layer. By manipulating this parameter, an unauthenticated attacker can inject shell commands that are executed with the privileges of the web service process. The attack chain relies on calling the nas-web.eject_disk method, which was accessible through the default /rPC endpoint in vulnerable versions. GL.iNet's remediation in version 4.7 introduced HTTP RPC layer validation that blocks eject_disk from being whitelisted, preventing the exploit chain from being initiated.

Business impact

Organizations deploying GL-MT3000 devices as network infrastructure—particularly in small office/branch office (SOBO) or remote access scenarios—face risk of complete device compromise. An attacker gaining command execution could steal network traffic, modify router configurations, pivot to internal networks, or use the device for botnet participation. The unauthenticated, network-accessible nature of the flaw means any internet-facing GL-MT3000 is at immediate risk. Recovery typically requires manual intervention and potential re-imaging of affected devices.

Affected systems

GL.iNet GL-MT3000 devices running firmware versions prior to 4.7 are affected. The vulnerability is present in version 4.4.5 and earlier. Devices running firmware 4.7 or later contain the mitigating validation controls and are not vulnerable. Organizations should verify firmware versions across all deployed GL-MT3000 units and prioritize updates in internet-facing or perimeter deployments.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and no special network conditions—only network reachability to the device's HTTP RPC interface. The attack is straightforward to execute remotely using standard HTTP requests. The CVSS 3.1 score of 7.3 (High) reflects the low attack complexity and the ability to achieve confidentiality, integrity, and availability impacts. No known public exploits are currently tracked in the CISA KEV catalog, but the simplicity of the attack vector means exploitation risk is substantial and will likely increase once detailed technical information becomes widely available.

Remediation

The primary remediation is to upgrade all affected GL-MT3000 devices to firmware version 4.7 or later. This update includes the method-level validation that prevents the vulnerable eject_disk function from being accessible via the default RPC endpoint. Administrators should plan a firmware rollout, testing the upgrade in a non-production environment first to ensure compatibility with custom configurations. Until updates can be deployed, consider restricting network access to the device's HTTP interface using firewall rules or VPN gating, limiting exposure to trusted networks only.

Patch guidance

GL.iNet has released firmware version 4.7 as the official remediation. Administrators should obtain the latest firmware from GL.iNet's official download portal and follow their documented upgrade procedure. Verify the firmware version before and after the upgrade to confirm successful deployment. Organizations should establish a change control process to coordinate updates across multiple GL-MT3000 devices and document the patching timeline for compliance purposes. If your environment has custom RPC extensions, test them thoroughly on version 4.7 before production rollout.

Detection guidance

Monitor HTTP logs for unexpected calls to the /rpc endpoint with suspicious dev_name parameters or attempts to invoke nas-web.eject_disk. Look for payloads containing shell metacharacters (|, ;, $, backticks, &&, ||) embedded in HTTP POST parameters. Network-based detection can flag requests to the RPC interface from untrusted sources. On the device itself, audit syslog and process execution logs for unusual command activity originating from the web service user. Intrusion detection signatures should key on the path /usr/lib/oui-httpd/rpc/ and method names attempting to call eject_disk.

Why prioritize this

This vulnerability warrants immediate attention due to its high CVSS score (7.3), unauthenticated remote exploitability, and the complete device compromise it enables. Organizations should prioritize patching GL-MT3000 devices, especially those exposed to untrusted networks. While not yet in the CISA KEV catalog, the straightforward attack methodology and high impact make this a natural target for active exploitation. Firmware updates are straightforward and impose minimal operational risk.

Risk score, explained

The CVSS 3.1 score of 7.3 (High) reflects: (1) network-based remote attack vector with no authentication required (AV:N, PR:N); (2) low attack complexity requiring only standard HTTP requests (AC:L); (3) no user interaction needed (UI:N); (4) impact on confidentiality, integrity, and availability (C:L, I:L, A:L). While the impact ratings are 'Low' individually, the combination of unauthenticated remote code execution on a network device capable of affecting downstream systems justifies the High severity rating.

Frequently asked questions