CVE-2026-11451: GL.iNet GL-MT3000 Remote Command Injection in FTP Handler

Technical summary

CVE-2026-11451 is a command injection flaw in the GL-MT3000's /cgi-bin/glc endpoint, specifically within the FTP Protocol Handler component's snprintf call. The vulnerability stems from insufficient input validation on the media_dir argument, allowing an unauthenticated attacker to break out of a configuration string context using single-quote closure and command separator syntax (e.g., '; command #'). The attack surface is the HTTP-based CGI interface, making it accessible over the network. The vendor's fix in 4.8.1 introduces the escape_single_quote() function to neutralize shell metacharacters before writing the media_dir value into the vsftpd.conf configuration file. Testing by the vendor confirmed that payloads effective against 4.4.5 fail to execute code under 4.8.1's sanitization logic.

Business impact

This vulnerability enables unauthenticated remote command execution on affected GL-MT3000 devices, potentially granting attackers complete control over the router. An attacker could use this access to pivot into the local network, exfiltrate traffic, modify network policies, disrupt service availability, or use the device as a launching point for further attacks. Organizations relying on GL-MT3000 for network perimeter or NAS functionality face significant operational and data confidentiality risk if devices remain unpatched.

Affected systems

GL.iNet GL-MT3000 running firmware version 4.4.5 is confirmed vulnerable. Devices running firmware version 4.8.1 or later are not affected. Organizations should audit their deployed GL-MT3000 fleet to determine current firmware versions and identify devices still on 4.4.5 or other intermediate versions prior to 4.8.1.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no complex network conditions—an attacker on the internet can trigger it by sending a crafted HTTP request to the /cgi-bin/glc endpoint with a malicious media_dir payload. No special privileges or system access are needed to launch the attack. The CVSS 3.1 score of 7.3 (HIGH) reflects the remote, unauthenticated nature and the impact scope (confidentiality, integrity, and availability).

Remediation

The definitive remediation is to upgrade affected GL-MT3000 devices to firmware version 4.8.1 or later. Organizations unable to upgrade immediately should consider network-level mitigations: restrict access to the GL-MT3000's management interface to trusted IP addresses, place the device behind a firewall with strict ingress rules, or disable the FTP protocol handler if it is not required for operations. Verify that upgrades are completed across the entire fleet and establish a process to monitor for future firmware updates from GL.iNet.

Patch guidance

Download and apply firmware version 4.8.1 or later from GL.iNet's official support channels. Before deploying in production, test the upgrade on a non-critical device or in a lab environment to confirm compatibility with your network configuration and any custom settings. The patch is straightforward to apply and does not require special prerequisites; follow GL.iNet's standard firmware update procedure. After upgrade, verify that the device reports firmware version 4.8.1 or higher via the device's web interface or CLI.

Detection guidance

Monitor HTTP access logs to the /cgi-bin/glc endpoint for unusual activity, particularly requests containing shell metacharacters (single quotes, semicolons, pipes, backticks) in the media_dir parameter. Network intrusion detection systems should be tuned to flag HTTP requests with suspicious command injection patterns directed at GL-MT3000 devices. Endpoint detection and response (EDR) tools on systems with network visibility to the router should alert on unexpected process execution spawned by the FTP or HTTP service. Conduct a firmware inventory of all deployed GL-MT3000 units to identify those on vulnerable versions.

Why prioritize this

This vulnerability should be treated as a critical priority. It allows unauthenticated remote code execution with no exploitation complexity on a network infrastructure device. The router's position in the network architecture makes it a high-value target for lateral movement, and compromise could go undetected if monitoring is inadequate. The fix is available and straightforward to deploy, making remediation feasible without long-term operational burden. Any GL-MT3000 device on version 4.4.5 exposed to untrusted networks should be patched immediately.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: (1) Network-based attack vector with no authentication required, (2) low attack complexity, (3) impact to confidentiality (attacker can read router and network data), integrity (attacker can modify configuration and inject commands), and availability (attacker can disrupt or crash services). The scope is unchanged (the router itself is the impacted resource). The score appropriately captures the severity of unauthenticated RCE on infrastructure hardware, though organizations with this device should treat it as functionally critical given its network role.

Frequently asked questions