PT-2026-47168

CVE-2026-11447

Published

2026-06-07

Updated

2026-06-07

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.7

Description A remote command injection flaw exists in the MTK Backend component within the iwinfo backend() function of the iwinfo.so file. The issue occurs when the device argument is manipulated, allowing an attacker to execute arbitrary commands remotely.

Recommendations Update to version 4.7. Upgrade the affected MTK Backend component.

Exploitability

Exploit

Fix

Impacts

Researchers

Strforexc

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')