CVE-2026-11447

MEDIUM 6.3

GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection

CVSS Score

6.3

EPSS Score

0.9%

EPSS Percentile

75th

A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfo_backend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 4.7 is recommended to address this issue. Upgrading the affected component is recommended. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

CWE	CWE-77 CWE-74
Vendor	gl.inet
Product	gl-mt3000
Published	Jun 7, 2026
Last Updated	Jun 8, 2026

Stay Ahead of the Next One

Get instant alerts for gl.inet gl-mt3000

Be the first to know when new medium vulnerabilities affecting gl.inet gl-mt3000 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

GL.iNet / GL-MT3000

4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/369067 vuldb.com: https://vuldb.com/vuln/369067/cti vuldb.com: https://vuldb.com/cve/CVE-2026-11447 vuldb.com: https://vuldb.com/submit/824951 github.com: https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/iwinfo_scan_ubus_rce

Credits

🔍 strforexc (VulDB User) VulDB CNA Team