Quick answers
- Is CVE-2026-11447 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11447 being exploited in the wild.
- How severe is CVE-2026-11447?
- Medium severity, with a CVSS score of 6.3, published 7 June 2026.
- Which products and versions are affected?
- GL.iNet GL-MT3000 up to 4.4.5.
- Is there a fix for CVE-2026-11447?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-11447 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-11447?
- Check whether you run GL.iNet GL-MT3000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability exists in the GL.iNet GL-MT3000 router (firmware up to 4.4.5) within the iwinfo_backend function of the iwinfo.so library, part of the MTK Backend component. The issue stems from improper neutralization of the 'device' argument, allowing an attacker to inject malicious commands. While the attack can be executed remotely over the network, it requires low-level privileges (PR:L). Successful exploitation allows for arbitrary command execution on the underlying operating system. A public exploit has been released. The vendor has addressed this in version 4.7 by implementing global injection protection in the SDK.
Affected products
- GL.iNet GL-MT3000 up to 4.4.5
Timeline
- 2026-06-07: advisory: NVD publication date
- 2026-06-07: disclosed: Public disclosure of the vulnerability and exploit