# CVE-2026-11447: GL.iNet GL-MT3000 command injection in MTK Backend

Source: https://junglewise.ai/threats/cve-2026-11447-gl-inet-gl-mt3000-command-injection-in-mtk-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-11447 · Severity: medium · CVSS 6.3 · Published 2026-06-07

A security vulnerability has been identified in the GL.iNet GL-MT3000 wireless router. This flaw allows an attacker to execute unauthorized commands on the device, which could lead to a complete takeover of the router, interception of network traffic, or disruption of internet services. Users are advised to upgrade to firmware version 4.7 to protect their devices.

Technologies: [GL.iNet GL-MT3000](https://junglewise.ai/threats/technologies/gl-mt3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-11447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11447 being exploited in the wild.

**How severe is CVE-2026-11447?** Medium severity, with a CVSS score of 6.3, published 7 June 2026.

**Which products and versions are affected?** GL.iNet GL-MT3000 up to 4.4.5.

**Is there a fix for CVE-2026-11447?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11447 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11447?** Check whether you run GL.iNet GL-MT3000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the GL.iNet GL-MT3000 router (firmware up to 4.4.5) within the iwinfo_backend function of the iwinfo.so library, part of the MTK Backend component. The issue stems from improper neutralization of the 'device' argument, allowing an attacker to inject malicious commands. While the attack can be executed remotely over the network, it requires low-level privileges (PR:L). Successful exploitation allows for arbitrary command execution on the underlying operating system. A public exploit has been released. The vendor has addressed this in version 4.7 by implementing global injection protection in the SDK.

## Affected products

- GL.iNet GL-MT3000 up to 4.4.5

## Timeline

- 2026-06-07: advisory: NVD publication date
- 2026-06-07: disclosed: Public disclosure of the vulnerability and exploit

## References

- [https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/iwinfo_scan_ubus_rce](https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/iwinfo_scan_ubus_rce)
- [https://vuldb.com/cve/CVE-2026-11447](https://vuldb.com/cve/CVE-2026-11447)
- [https://vuldb.com/submit/824951](https://vuldb.com/submit/824951)
- [https://vuldb.com/vuln/369067](https://vuldb.com/vuln/369067)
- [https://vuldb.com/vuln/369067/cti](https://vuldb.com/vuln/369067/cti)

## Related threats

- [GL-iNet GL-MT3000 command injection in wg-server](https://junglewise.ai/threats/cve-2026-18616-gl-inet-gl-mt3000-command-injection-in-wg-server)
- [GL-iNet GL-MT3000 command injection in wg-server](https://junglewise.ai/threats/cve-2026-18615-gl-inet-gl-mt3000-command-injection-in-wg-server)
- [GL-iNet GL-MT3000 command injection in s2s.so](https://junglewise.ai/threats/cve-2026-18614-gl-inet-gl-mt3000-command-injection-in-s2s-so)
- [GL.iNet GL-MT3000 command injection in Online Firmware Upgrade Handler](https://junglewise.ai/threats/cve-2026-12187-gl-inet-gl-mt3000-command-injection-in-online-firmware-upgrade)
- [GL.iNet GL-MT3000 command injection in Tor Proxy Service Configuration Handler](https://junglewise.ai/threats/cve-2026-12186-gl-inet-gl-mt3000-command-injection-in-tor-proxy-service)