Read the docs
TI-2026-09881 Aliases CVE-2026-11452GHSA-5qf6-3rw8-7jgg

GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection

Priority MEDIUM 40CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " The current code escapes single quotes in the password parameter and handles it inside a shell single‑quote context. The payloads in the report, which rely on $() or backticks to trigger command substitution, are not executed under the current code path. We tested on a GL‑MT3000 device running firmware 4.8.1 using similar payloads, and no command‑execution marker file was created."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01849 79th percentileScored 2026-11-08
Fix Fixed GL-MT3000 (GL.iNet): 4.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GL.iNetGL-MT30004.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.54.8.1Patch availableCNA
  • GL-MT3000 VendorGL.iNet Affected 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4; 4.4.5 Fixed in 4.8.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*——GL.iNet
  • cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:* Versions — — ·GL.iNet

Remediation

  • Fix · CNA GL-MT3000 (GL.iNet) Fixed in 4.8.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11452
  2. 2026-10-03 Alias added: GHSA-5qf6-3rw8-7jgg

References

Other 1

  • TI-2026-21387 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2024-26219 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750… CVSS 3.1CRITICAL 9.8
  • TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
  • TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
  • TI-2023-14015 GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. CVSS 3.1CRITICAL 9.8
  • TI-2026-15312 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection CVSS 4.0CRITICAL 9.3
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences