# CVE-2026-11449: GL.iNet GL-MT3000 command injection in LuCI JSON-RPC interface

Source: https://junglewise.ai/threats/cve-2026-11449-gl-inet-gl-mt3000-command-injection-in-luci-json-rpc-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-11449 · Severity: medium · CVSS 6.3 · Published 2026-06-07

A security vulnerability exists in the GL.iNet GL-MT3000 router firmware that could allow an authenticated user to take full control of the device. By sending specially crafted requests to the router's management interface, an attacker can execute system-level commands. This could lead to complete device compromise, interception of network traffic, or disruption of internet services.

Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-11449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11449 being exploited in the wild.

**How severe is CVE-2026-11449?** Medium severity, with a CVSS score of 6.3, published 7 June 2026.

**Which products and versions are affected?** GL.iNet GL-MT3000 Firmware 4.4.5.

**Is there a fix for CVE-2026-11449?** A patch was published on 2026-08-19: Firmware version 4.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11449 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-11449?** Check whether you run GL.iNet GL-MT3000 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the LuCI JSON-RPC interface of GL.iNet GL-MT3000 firmware version 4.4.5. The vulnerability is located in the rpc_sys function within /cgi-bin/luci/rpc. The root cause is a failure to implement a method whitelist when cloning the luci.sys module; the jsonrpc.handle function uses reflective table lookup (rawget) to dispatch requested methods. Because luci.sys.exec is aliased to luci.util.exec (which utilizes io.popen), an authenticated attacker with root-level credentials can execute arbitrary shell commands as root and receive the output in the JSON-RPC response. The vendor has mitigated this in newer versions (4.7.13+) by removing LuCI by default and has released a fix in version 4.8.1.

## Affected products

- GL.iNet GL-MT3000 Firmware 4.4.5

## Timeline

- 2026-05-11: disclosed: Vulnerability submitted by researcher
- 2026-06-07: advisory: NVD publication date
- 2026-08-19: patched: Firmware version 4.8.1 released

## References

- [https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar](https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar)
- [https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/luci_rpc_sys_exec_rce](https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/luci_rpc_sys_exec_rce)
- [https://vuldb.com/cve/CVE-2026-11449](https://vuldb.com/cve/CVE-2026-11449)
- [https://vuldb.com/submit/825385](https://vuldb.com/submit/825385)
- [https://vuldb.com/vuln/369069](https://vuldb.com/vuln/369069)
- [https://vuldb.com/vuln/369069/cti](https://vuldb.com/vuln/369069/cti)