Attack Chain

1. An attacker identifies a GL.iNet GL-MT3000 router running a vulnerable firmware version (up to 4.4.5) that is accessible remotely.
2. The attacker crafts a malicious HTTP POST request targeting the /cgi-bin/glc endpoint on the vulnerable router.
3. The request includes a specially formed Password argument containing shell metacharacters (e.g., ;, |, $(, `) designed for command injection.
4. The vulnerable SET_USER_PWD Handler function (FUN_0042e200) within the router's firmware processes this unvalidated Password argument.
5. The embedded shell metacharacters are interpreted and executed by the underlying operating system shell, leading to remote command injection.
6. The attacker successfully executes arbitrary commands on the router, potentially establishing a reverse shell or downloading additional malware.
7. The attacker proceeds to gain full control over the router, allowing them to modify network settings, intercept traffic, or use the device as a pivot point for further network compromise.
8. This allows for network compromise, data exfiltration, or the establishment of a persistent foothold within the victim's network.

Impact

Successful exploitation of CVE-2026-11452 grants remote attackers full control over the affected GL.iNet GL-MT3000 router. The impact includes unauthorized access to the network segment the router controls, potential for data interception, modification of DNS settings to redirect users to malicious sites, or the installation of persistent backdoors. Compromised routers can be leveraged as part of botnets for DDoS attacks or as proxies for other malicious activities, significantly degrading network performance and security. The broad deployment of such devices makes them attractive targets for attackers seeking initial access to home or small business networks.

Recommendation

• Immediately upgrade all GL.iNet GL-MT3000 routers to firmware version 4.8.1 or later to mitigate CVE-2026-11452.
• Deploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against the /cgi-bin/glc endpoint.
• Enable comprehensive web server logging for all internet-facing devices, specifically monitoring requests to /cgi-bin/glc for suspicious cs-uri-query patterns.