CVE-2026-11406

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11406", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-05T18:26:22.054Z", "datePublished": "2026-06-06T09:15:12.019Z", "dateUpdated": "2026-06-08T16:27:56.919Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T09:15:12.019Z"}, "title": "GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "GL.iNet", "product": "MT3000", "versions": [{"version": "4.4.0", "status": "affected"}, {"version": "4.4.1", "status": "affected"}, {"version": "4.4.2", "status": "affected"}, {"version": "4.4.3", "status": "affected"}, {"version": "4.4.4", "status": "affected"}, {"version": "4.4.5", "status": "affected"}, {"version": "4.9.0_beta3-1012-0513-1778656146", "status": "unaffected"}], "cpes": ["cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["OpenVPN Client Import Workflow"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: \"This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-05T20:31:32.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "strforexc (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/368966", "name": "VDB-368966 | GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/368966/cti", "name": "VDB-368966 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11406", "name": "CVE-2026-11406 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/820049", "name": "Submit #820049 | GL.iNet MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/ovpn_client_import", "tags": ["exploit"]}, {"url": "https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T16:27:49.061711Z", "id": "CVE-2026-11406", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:27:56.919Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11406", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T16:27:49.061711Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T16:27:28.137Z"}}], "cna": {"title": "GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection", "credits": [{"lang": "en", "type": "reporter", "value": "strforexc (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*"], "vendor": "GL.iNet", "modules": ["OpenVPN Client Import Workflow"], "product": "MT3000", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}, {"status": "unaffected", "version": "4.9.0_beta3-1012-0513-1778656146"}]}], "timeline": [{"lang": "en", "time": "2026-06-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-05T20:31:32.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/368966", "name": "VDB-368966 | GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/368966/cti", "name": "VDB-368966 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11406", "name": "CVE-2026-11406 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/820049", "name": "Submit #820049 | GL.iNet MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/ovpn_client_import", "tags": ["exploit"]}, {"url": "https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: \"This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-06T09:15:12.019Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11406", "state": "PUBLISHED", "dateUpdated": "2026-06-08T16:27:56.919Z", "dateReserved": "2026-06-05T18:26:22.054Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-06T09:15:12.019Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["OpenVPN Client Import Workflow"], "product": "MT3000", "vendor": "GL.iNet", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}, {"status": "unaffected", "version": "4.9.0_beta3-1012-0513-1778656146"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: \"This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files.\""}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en GL.iNet MT3000 hasta 4.4.5. Esta vulnerabilidad afecta c\u00f3digo desconocido del archivo ovpnclient.sh del componente Flujo de Trabajo de Importaci\u00f3n de Cliente OpenVPN. Esta manipulaci\u00f3n provoca inyecci\u00f3n de comandos. Es posible la explotaci\u00f3n remota del ataque. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. La actualizaci\u00f3n a la versi\u00f3n 4.9.0_beta3-1012-0513-1778656146 puede resolver este problema. Deber\u00eda actualizar el componente afectado. El proveedor confirma: 'Este problema ha sido abordado mediante la implementaci\u00f3n de comprobaciones maliciosas en los archivos de configuraci\u00f3n de OpenVPN para prevenir ataques de inyecci\u00f3n de comandos realizados a trav\u00e9s de archivos de configuraci\u00f3n maliciosos.'"}], "id": "CVE-2026-11406", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11406", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T16:27:49.061711Z", "version": "2.0.3"}}]}, "published": "2026-06-06T10:16:27.017", "references": [{"source": "cna@vuldb.com", "url": "https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar"}, {"source": "cna@vuldb.com", "url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/ovpn_client_import"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11406"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/820049"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368966"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368966/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.9.0_beta3-1012-0513-1778656146"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MT3000", "source": "cna", "vendor": "GL.iNet"}, "product": "mt3000", "vendor": "gl-inet"}], "created": "2026-06-06T11:30:19.097875+00:00", "updated": "2026-06-06T11:30:19.390369+00:00", "vendors": ["gl-inet", "gl-inet$PRODUCT$mt3000"]}