CVE-2026-12186: GL.iNet GL-MT3000 Command Injection in Tor Proxy Handler

Technical summary

CVE-2026-12186 is a command injection vulnerability (CWE-74, CWE-77) in the Tor Proxy Service Configuration Handler component of GL.iNet GL-MT3000. The vulnerable function replace_country in /usr/lib/oui-httpd/rpc/tor fails to properly sanitize user input, allowing an authenticated user to inject shell metacharacters and execute arbitrary commands with the privileges of the httpd process. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, and high impact to confidentiality, integrity, and availability.

Business impact

This vulnerability poses a significant risk to organizations deploying GL-MT3000 routers as edge devices or VPN endpoints. Compromised routers can be weaponized for lateral network movement, data exfiltration, man-in-the-middle attacks, or denial of service. The attack surface expands in environments where routers are internet-facing or accessible to untrusted users. For service providers offering Tor-based privacy solutions via these devices, unauthorized command execution undermines service integrity and customer trust.

Affected systems

GL.iNet GL-MT3000 routers running firmware versions up to and including 4.4.5 are affected. The vulnerability exists in the Tor proxy configuration handler, so systems with Tor services enabled are most at risk. Inventory should focus on identifying deployed GL-MT3000 units and their current firmware versions to prioritize remediation. Verify against GL.iNet's official product documentation for the complete version timeline.

Exploitability

The vulnerability requires authenticated access, which significantly limits opportunistic exploitation but does not eliminate risk in environments with weak credential hygiene or shared administrative access. Public exploit code is available, lowering the technical barrier for motivated threat actors. Once authenticated, exploitation is straightforward due to low attack complexity—no special conditions or timing are needed. This makes the vulnerability practical for insider threats and attacks against routers with compromised or default credentials.

Remediation

Upgrade GL-MT3000 devices to firmware version 4.7 or later. This is a vendor-provided fix and should be treated as a critical patch. Before upgrading, document current configurations and verify compatibility with your deployment. Test in a non-production environment if the router is business-critical. Ensure automatic firmware updates are enabled if supported. As an interim control, restrict administrative access to trusted networks only and review user account permissions.

Patch guidance

GL.iNet released version 4.7 to address this issue. Obtain the firmware from GL.iNet's official website or through the router's built-in update mechanism. Verify the firmware image's cryptographic signature if provided by the vendor to ensure authenticity. Plan the upgrade during a maintenance window to avoid service disruption. Roll out patches to production routers in phases, starting with development or test units. Document patch deployment and verify version compliance post-upgrade using the router's administration interface.

Detection guidance

Monitor for suspicious Tor proxy configuration changes in audit logs and system activity. Look for unexpected command execution traces from the httpd process, particularly those containing shell metacharacters (pipes, semicolons, backticks, command substitution syntax). Network-based detection should flag unusual administrative API calls to the Tor service configuration endpoints. Review web server access logs for POST requests to /usr/lib/oui-httpd/rpc/tor with suspicious payloads. Consider deploying endpoint detection and response (EDR) tools on critical infrastructure that depends on these routers.

Why prioritize this

Despite requiring authentication, this vulnerability merits urgent prioritization due to its HIGH CVSS score (8.8), the availability of public exploits, and the critical role routers play in network perimeter security. The impact severity—full system compromise—combined with the low complexity of exploitation creates substantial risk. Organizations should patch before threat actors systematize attacks against unpatched GL-MT3000 fleets, especially if the routers are used in sensitive network segments or for privacy-critical functions.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible vulnerability with low attack complexity (AC:L) that requires authenticated access (PR:L). The high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) drives the overall severity. The score does not account for exploit availability or threat actor capability, but both are confirmed as present. The authentication requirement prevents the score from reaching critical (9.0+), but should not be used to justify delaying patches in environments where administrative credentials are shared or where internal threat modeling suggests plausible compromise scenarios.

Frequently asked questions