CVE-2026-11450

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11450", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-06T10:33:18.124Z", "datePublished": "2026-06-07T02:30:09.365Z", "dateUpdated": "2026-06-08T15:30:18.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-07T02:30:09.365Z"}, "title": "GL.iNet GL-MT3000 Path Normalization dlopen command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "GL.iNet", "product": "GL-MT3000", "versions": [{"version": "4.4.5", "status": "affected"}, {"version": "4.7", "status": "unaffected"}], "cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["Path Normalization Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component. The vendor confirms: \" From version 4.7 onward, we have enabled method\u2011level validation at the HTTP /rpc layer. nas\u2011web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-06T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-06T12:38:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "strforexc (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/369070", "name": "VDB-369070 | GL.iNet GL-MT3000 Path Normalization dlopen command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369070/cti", "name": "VDB-369070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11450", "name": "CVE-2026-11450 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/825536", "name": "Submit #825536 | GL.iNet GL-MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce", "tags": ["related"]}]}, "adp": [{"references": [{"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T15:29:48.595354Z", "id": "CVE-2026-11450", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:30:18.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11450", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T15:29:48.595354Z"}}}], "references": [{"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T15:30:07.543Z"}}], "cna": {"title": "GL.iNet GL-MT3000 Path Normalization dlopen command injection", "credits": [{"lang": "en", "type": "reporter", "value": "strforexc (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "vendor": "GL.iNet", "modules": ["Path Normalization Handler"], "product": "GL-MT3000", "versions": [{"status": "affected", "version": "4.4.5"}, {"status": "unaffected", "version": "4.7"}]}], "timeline": [{"lang": "en", "time": "2026-06-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-06T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-06T12:38:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/369070", "name": "VDB-369070 | GL.iNet GL-MT3000 Path Normalization dlopen command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/369070/cti", "name": "VDB-369070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11450", "name": "CVE-2026-11450 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/825536", "name": "Submit #825536 | GL.iNet GL-MT3000 4.4.5 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component. The vendor confirms: \" From version 4.7 onward, we have enabled method\u2011level validation at the HTTP /rpc layer. nas\u2011web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-07T02:30:09.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11450", "state": "PUBLISHED", "dateUpdated": "2026-06-08T15:30:18.217Z", "dateReserved": "2026-06-06T10:33:18.124Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-07T02:30:09.365Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "modules": ["Path Normalization Handler"], "product": "GL-MT3000", "vendor": "GL.iNet", "versions": [{"status": "affected", "version": "4.4.5"}, {"status": "unaffected", "version": "4.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component. The vendor confirms: \" From version 4.7 onward, we have enabled method\u2011level validation at the HTTP /rpc layer. nas\u2011web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report.\""}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en GL.iNet GL-MT3000 4.4.5. Esto afecta la funci\u00f3n dlopen en la biblioteca /usr/lib/oui-httpd/rpc/ del componente Gestor de Normalizaci\u00f3n de Rutas. Realizar una manipulaci\u00f3n del argumento dev_name resulta en inyecci\u00f3n de comandos. Es posible iniciar el ataque remotamente. Actualizar a la versi\u00f3n 4.7 mitiga este problema. Es aconsejable actualizar el componente afectado. El proveedor confirma: 'A partir de la versi\u00f3n 4.7, hemos habilitado la validaci\u00f3n a nivel de m\u00e9todo en la capa HTTP /rpc. nas?web.eject_disk ya no est\u00e1 en la lista blanca de m\u00e9todos permitidos. En consecuencia, llamar directamente a eject_disk a trav\u00e9s del endpoint /rpc predeterminado devuelve 'Invalid params', impidiendo la entrada a funciones peligrosas subsiguientes y bloqueando la cadena de exploit remoto descrita en el informe.'"}], "id": "CVE-2026-11450", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11450", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T15:29:48.595354Z", "version": "2.0.3"}}]}, "published": "2026-06-07T03:16:27.247", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11450"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/825536"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369070"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/369070/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "GL-MT3000", "source": "cna", "vendor": "GL.iNet"}, "product": "gl-mt3000", "vendor": "gl-inet"}], "created": "2026-06-07T03:30:34.915339+00:00", "updated": "2026-06-07T16:30:04.077481+00:00", "vendors": ["gl-inet", "gl-inet$PRODUCT$gl-mt3000"]}