PT-2026-49144

CVE-2026-12186

Published

2026-06-14

Updated

2026-07-24

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.7

Description A command injection flaw exists in the Tor Proxy Service Configuration Handler. The issue is located within the replace country() function in the /usr/lib/oui-httpd/rpc/tor library, allowing a remote attacker to execute arbitrary commands.

Recommendations Upgrade to version 4.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Strforexc

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')