PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11450 GL.iNet CVE debrief

A command injection vulnerability was detected in GL.iNet GL-MT3000 version 4.4.5. This vulnerability affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. An attacker can manipulate the argument dev_name to inject commands, allowing for a remote attack. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Upgrading to version 4.7 mitigates this issue, as it enables method-level validation at the HTTP /rpc layer, removing nas-web.eject_disk from the whitelist of allowed methods.

Vendor
GL.iNet
Product
GL-MT3000
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-07
Original CVE updated
2026-06-08
Advisory published
2026-06-07
Advisory updated
2026-06-08

Who should care

Administrators and users of GL.iNet GL-MT3000 version 4.4.5 should be aware of this vulnerability and take action to upgrade to version 4.7 or later to prevent potential remote attacks.

Technical summary

The vulnerability is caused by improper path normalization in the dlopen function of the /usr/lib/oui-httpd/rpc/ library. An attacker can exploit this by manipulating the dev_name argument to inject commands. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade GL.iNet GL-MT3000 to version 4.7 or later.
  • Implement method-level validation at the HTTP /rpc layer to restrict allowed methods.

Evidence notes

The vendor confirms that from version 4.7 onward, method-level validation has been enabled at the HTTP /rpc layer, and nas-web.eject_disk is no longer in the whitelist of allowed methods, preventing the remote exploit chain.

Official resources

CVE-2026-11450 was published on 2026-06-07T03:16:27.247Z and modified on 2026-06-08T16:16:36.420Z.