CVE-2026-11448
published 2026-06-07CVE-2026-11448: A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna…
PriorityP334medium4.7CVSS 3.1
AVNACLPRHUINSUCLILAL
EPSS
1.58%
72.5th percentile
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gl.inet | gl-mt3000 | — | — |
| gl.inet | gl-mt3000 | — | — |
| gl.inet | gl-mt3000 | — | — |
| gl.inet | gl-mt3000 | — | — |
| gl.inet | gl-mt3000 | — | — |
| gl.inet | gl-mt3000 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.8MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5.
ghsa_unreviewed·2026-06-07
CVE-2026-11448 [MEDIUM] CWE-74 A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5.
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".
VulDB
GL.iNet GL-MT3000 up to 4.4.5 Minidlna Service /rpc realpath kube. set command injection
vuldb·2026-06-06
CVE-2026-11448 [CRITICAL] GL.iNet GL-MT3000 up to 4.4.5 Minidlna Service /rpc realpath kube. set command injection
A vulnerability classified as critical has been found in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection.
This vulnerability is tracked as CVE-2026-11448. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/minidlna_db_dir_uci_rcehttps://vuldb.com/cve/CVE-2026-11448https://vuldb.com/submit/825212https://vuldb.com/vuln/369068https://vuldb.com/vuln/369068/ctihttps://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/minidlna_db_dir_uci_rce
2026-06-07
Published