# CVE-2026-11450: GL.iNet GL-MT3000 command injection in nas-web.so via /cgi-bin/glc

Source: https://junglewise.ai/threats/cve-2026-11450-gl-inet-gl-mt3000-command-injection-in-nas-web-so-via-cgi-bin-glc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-11450 · Severity: high · CVSS 7.3 · Published 2026-06-07

A security vulnerability exists in the GL.iNet GL-MT3000 router that allows an unauthorized person to take control of the device over the network. By sending a specially crafted request to the router's web management interface, an attacker can execute arbitrary commands. This could lead to a complete compromise of the device, allowing attackers to intercept network traffic or disrupt internet services.

Technologies: [GL.iNet GL-MT3000](https://junglewise.ai/threats/technologies/gl-mt3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-11450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11450 being exploited in the wild.

**How severe is CVE-2026-11450?** High severity, with a CVSS score of 7.3, published 7 June 2026.

**Which products and versions are affected?** GL.iNet GL-MT3000 4.4.5.

**Is there a fix for CVE-2026-11450?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11450 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-11450?** Check whether you run GL.iNet GL-MT3000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated command injection vulnerability exists in the /cgi-bin/glc endpoint of GL.iNet GL-MT3000 firmware version 4.4.5. The glc CGI binary dynamically loads shared object plugins from /usr/lib/oui-httpd/rpc/ using dlopen() and executes exported functions via dlsym() without authentication or method whitelisting. Specifically, the nas-web.so plugin's eject_disk_do1 function fails to properly sanitize the dev_name parameter. An attacker can exploit a buffer size mismatch and Linux path normalization to bypass access() checks and inject shell commands into a system() call. The issue is mitigated in version 4.7 by implementing method-level validation and removing nas-web.eject_disk from the allowed RPC whitelist.

## Affected products

- GL.iNet GL-MT3000 4.4.5

## Timeline

- 2026-05-11: disclosed: Initial researcher submission
- 2026-06-07: advisory: NVD publication date

## References

- [https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce](https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_disk_do1_glc_rce)
- [https://vuldb.com/cve/CVE-2026-11450](https://vuldb.com/cve/CVE-2026-11450)
- [https://vuldb.com/submit/825536](https://vuldb.com/submit/825536)
- [https://vuldb.com/vuln/369070](https://vuldb.com/vuln/369070)
- [https://vuldb.com/vuln/369070/cti](https://vuldb.com/vuln/369070/cti)

## Related threats

- [GL-iNet GL-MT3000 command injection in wg-server](https://junglewise.ai/threats/cve-2026-18616-gl-inet-gl-mt3000-command-injection-in-wg-server)
- [GL-iNet GL-MT3000 command injection in wg-server](https://junglewise.ai/threats/cve-2026-18615-gl-inet-gl-mt3000-command-injection-in-wg-server)
- [GL-iNet GL-MT3000 command injection in s2s.so](https://junglewise.ai/threats/cve-2026-18614-gl-inet-gl-mt3000-command-injection-in-s2s-so)
- [GL.iNet GL-MT3000 command injection in Online Firmware Upgrade Handler](https://junglewise.ai/threats/cve-2026-12187-gl-inet-gl-mt3000-command-injection-in-online-firmware-upgrade)
- [GL.iNet GL-MT3000 command injection in Tor Proxy Service Configuration Handler](https://junglewise.ai/threats/cve-2026-12186-gl-inet-gl-mt3000-command-injection-in-tor-proxy-service)