Gl.Inet Gl-Mt3000 vulnerabilities

CVE-2026-12187 [HIGH] CWE-74 CVE-2026-12187: A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulner A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and ma

CVE-2026-12186 [HIGH] CWE-74 CVE-2026-12186: A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_co A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be use

CVE-2026-11452 [HIGH] CWE-74 CVE-2026-11452: A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e2 A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected componen

CVE-2026-11451 [HIGH] CWE-74 CVE-2026-11451: A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cg A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affect

CVE-2026-11450 [HIGH] CWE-74 CVE-2026-11450: A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the lib A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It i

CVE-2026-11447 [MEDIUM] CWE-74 CVE-2026-11447: A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinf A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading

CVE-2026-11449 [MEDIUM] CWE-74 CVE-2026-11449: A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the f A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc_sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version 4.8.1 is sufficient to resolve this issue. Upgrading the

CVE-2026-11448 [MEDIUM] CWE-74 CVE-2026-11448: A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the functio A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is reco