PT-2026-47170

CVE-2026-11449

Published

2026-06-07

Updated

2026-06-07

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.8.1

Description A command injection issue exists in the LuCI JSON-RPC Interface. A remote attacker can exploit this by manipulating the rpc sys() function within the '/cgi-bin/luci/rpc' file.

Recommendations Update to version 4.8.1. As a temporary mitigation, restrict access to the '/cgi-bin/luci/rpc' endpoint or disable the LuCI JSON-RPC Interface component.

Exploitability

Exploit

Fix

Impacts

Researchers

Strforexc

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers