CVE-2026-12187: GL.iNet GL-MT3000 Command Injection in Firmware Upgrade Handler

Technical summary

CVE-2026-12187 is a command injection vulnerability (CWE-74, CWE-77) affecting the /usr/bin/one_click_upgrade binary, which handles online firmware updates on GL-MT3000 devices. The vulnerability allows an authenticated user to manipulate input to the Online Firmware Upgrade Handler component, leading to unvalidated command execution. The attack vector is network-based with low attack complexity, requiring only valid credentials. The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact to confidentiality, integrity, and availability. Public disclosure of the vulnerability and availability of exploit code elevate operational risk.

Business impact

Compromise of GL-MT3000 routers—often deployed as primary network gateways in remote offices, branch locations, or home networks—poses significant business risk. An authenticated attacker could gain root-level access to pivot into internal networks, exfiltrate sensitive data, establish persistent backdoors, or disrupt connectivity. Organizations relying on these devices for site-to-site VPN, DNS filtering, or network segmentation should treat this as a priority remediation target. The public exploit availability shortens the window before opportunistic attacks become widespread.

Affected systems

GL.iNet GL-MT3000 devices running firmware versions 4.4.5 and earlier are affected. The vulnerability requires an authenticated session, meaning the attacker must possess valid credentials or have compromised an account with access to the web interface or SSH. Firmware version 4.7 and later include the fix.

Exploitability

This vulnerability is actively exploitable. It requires authenticated access (PR:L in the CVSS vector), which means an attacker must have valid credentials or prior network compromise. The public disclosure and available exploit code create a reliable attack path. The low attack complexity (AC:L) and network-based vector (AV:N) mean that once credentials are obtained—through credential stuffing, weak default passwords, or phishing—the exploitation step is straightforward. Organizations should assume that threat actors are testing this vulnerability against their deployed GL-MT3000 instances.

Remediation

The definitive remediation is to upgrade GL-MT3000 firmware to version 4.7 or later. Organizations should prioritize this patch across all affected devices. During the patching window, restrict administrative access to the device management interface (limit IP ranges that can access the web UI or SSH) and monitor for suspicious upgrade requests. Disable remote management features if not actively required.

Patch guidance

Verify your current GL-MT3000 firmware version via the device web interface (System > Firmware) or by SSH access. If running 4.4.5 or earlier, initiate the firmware upgrade to version 4.7 or the latest available release. Test the upgrade in a non-critical device first if possible. GL.iNet's upgrade process is typically available via the web interface under System > Firmware > Check and Install. Ensure stable power and network connectivity during the upgrade to avoid corruption. After patching, verify the new firmware version is in place and confirm device functionality.

Detection guidance

Monitor access logs to /usr/bin/one_click_upgrade for unusual command patterns or non-standard parameters. Watch for failed authentication attempts against the firmware upgrade interface or web admin panel, which may indicate credential attacks. Network-based detection should focus on HTTP/HTTPS POST requests to the firmware upgrade endpoints with suspicious payloads containing shell metacharacters (backticks, pipes, semicolons, $() substitution). Log analysis on affected devices should reveal command execution attempts in system logs. Organizations with Intrusion Detection Systems (IDS) or Web Application Firewalls (WAF) can create rules to flag requests to /usr/bin/one_click_upgrade with command injection signatures.

Why prioritize this

This vulnerability merits immediate prioritization due to the convergence of high CVSS score (8.8), public exploit availability, authenticated-but-common access path, and the criticality of routers as network entry points. GL-MT3000 devices are frequently used in distributed network architectures where compromise can enable lateral movement. The vendor's rapid response and availability of a stable patch version 4.7 means remediation is straightforward and low-risk, making delay unjustifiable.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) remote, unauthenticated network attack surface (AV:N); (2) low attack complexity due to straightforward command injection patterns (AC:L); (3) requirement for low-privilege credentials (PR:L), which are common in organization deployments; (4) no user interaction needed (UI:N); (5) complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The public disclosure and available exploit code do not change the numerical score but substantially increase practical exploitability. Organizations should treat this as urgent rather than deferred.

Frequently asked questions