CVE-2026-11448

MEDIUM 4.7

GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection

CVSS Score

4.7

EPSS Score

0.2%

EPSS Percentile

46th

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

CWE	CWE-77 CWE-74
Vendor	gl.inet
Product	gl-mt3000
Published	Jun 7, 2026
Last Updated	Jun 8, 2026

Stay Ahead of the Next One

Get instant alerts for gl.inet gl-mt3000

Be the first to know when new medium vulnerabilities affecting gl.inet gl-mt3000 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

GL.iNet / GL-MT3000

4.4.0 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/369068 vuldb.com: https://vuldb.com/vuln/369068/cti vuldb.com: https://vuldb.com/cve/CVE-2026-11448 vuldb.com: https://vuldb.com/submit/825212 github.com: https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/minidlna_db_dir_uci_rce

Credits

🔍 strforexc (VulDB User) VulDB CNA Team