CVE-2026-11449

MEDIUM 6.3

GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection

CVSS Score

6.3

EPSS Score

0.7%

EPSS Percentile

73th

A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpc_sys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version 4.8.1 is sufficient to resolve this issue. Upgrading the affected component is advised. The vendor confirms: "The issue discovered by the vulnerability researcher on older firmware versions(4.4.5) has actually been fixed and mitigated in the new version. According to the latest firmware fixes, by default, firmware versions after 4.7.13 do not install LuCI, so this vulnerability cannot be exploited."

CWE	CWE-77 CWE-74
Vendor	gl.inet
Product	gl-mt3000
Published	Jun 7, 2026
Last Updated	Jun 9, 2026

Stay Ahead of the Next One

Get instant alerts for gl.inet gl-mt3000

Be the first to know when new medium vulnerabilities affecting gl.inet gl-mt3000 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

GL.iNet / GL-MT3000

4.4.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/369069 vuldb.com: https://vuldb.com/vuln/369069/cti vuldb.com: https://vuldb.com/cve/CVE-2026-11449 vuldb.com: https://vuldb.com/submit/825385 github.com: https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/luci_rpc_sys_exec_rce fw.gl-inet.com: https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar

Credits

🔍 strforexc (VulDB User) VulDB CNA Team