{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agl_inetgl_mt3000_4_4_5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gl_inet:gl_mt3000_4_4_5:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-11452"},{"cvss":7.3,"id":"CVE-2026-11450"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HUNT-BENITO-GLINET-BERYL-AX-TRIPLE-RCE-CVE-2026-11450-11451-11452-UNAUTHENTICATED-ROOT-ON-TRAVEL-ROUTER\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["GL-MT3000 \u003c= 4.4.5 (\u003c= 4.4.5)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","command-injection","router","network"],"_cs_type":"advisory","_cs_vendors":["GL.iNet"],"content_html":"\u003cp\u003eA critical command injection vulnerability, tracked as CVE-2026-11452, has been identified in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides within the \u003ccode\u003eSET_USER_PWD Handler\u003c/code\u003e function (specifically FUN_0042e200) located in the \u003ccode\u003e/cgi-bin/glc\u003c/code\u003e file. This vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected router by submitting a specially crafted \u003ccode\u003ePassword\u003c/code\u003e argument. This manipulation bypasses intended security controls, leading to full compromise of the device. Successful exploitation could result in unauthorized network access, interception of network traffic, router configuration modification, or the inclusion of the device in a botnet. Upgrading to firmware version 4.8.1 or later is required to address this critical issue and prevent remote exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a GL.iNet GL-MT3000 router running a vulnerable firmware version (up to 4.4.5) that is accessible remotely.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/cgi-bin/glc\u003c/code\u003e endpoint on the vulnerable router.\u003c/li\u003e\n\u003cli\u003eThe request includes a specially formed \u003ccode\u003ePassword\u003c/code\u003e argument containing shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e, \u003ccode\u003e$(\u003c/code\u003e, \u003ccode\u003e`\u003c/code\u003e) designed for command injection.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003eSET_USER_PWD Handler\u003c/code\u003e function (FUN_0042e200) within the router's firmware processes this unvalidated \u003ccode\u003ePassword\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe embedded shell metacharacters are interpreted and executed by the underlying operating system shell, leading to remote command injection.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully executes arbitrary commands on the router, potentially establishing a reverse shell or downloading additional malware.\u003c/li\u003e\n\u003cli\u003eThe attacker proceeds to gain full control over the router, allowing them to modify network settings, intercept traffic, or use the device as a pivot point for further network compromise.\u003c/li\u003e\n\u003cli\u003eThis allows for network compromise, data exfiltration, or the establishment of a persistent foothold within the victim's network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11452 grants remote attackers full control over the affected GL.iNet GL-MT3000 router. The impact includes unauthorized access to the network segment the router controls, potential for data interception, modification of DNS settings to redirect users to malicious sites, or the installation of persistent backdoors. Compromised routers can be leveraged as part of botnets for DDoS attacks or as proxies for other malicious activities, significantly degrading network performance and security. The broad deployment of such devices makes them attractive targets for attackers seeking initial access to home or small business networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all GL.iNet GL-MT3000 routers to firmware version 4.8.1 or later to mitigate CVE-2026-11452.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against the \u003ccode\u003e/cgi-bin/glc\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging for all internet-facing devices, specifically monitoring requests to \u003ccode\u003e/cgi-bin/glc\u003c/code\u003e for suspicious \u003ccode\u003ecs-uri-query\u003c/code\u003e patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T03:31:26Z","date_published":"2026-06-14T23:25:50Z","id":"https://feed.craftedsignal.io/briefs/2026-06-glinet-gl-mt3000-command-injection/","summary":"A command injection vulnerability (CVE-2026-11452) has been discovered in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5, allowing remote attackers to execute arbitrary commands by manipulating the 'Password' argument in the '/cgi-bin/glc' endpoint.","title":"CVE-2026-11452: GL.iNet GL-MT3000 Command Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-06-glinet-gl-mt3000-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gl_inet:gl_mt3000_4_4_5:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}