CVE-2026-11451

{"id": "CVE-2026-11451", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11451", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T16:32:06.258338Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"], "vendor": "GL.iNet", "modules": ["FTP Protocol Handler"], "product": "GL-MT3000", "versions": [{"status": "affected", "version": "4.4.5"}, {"status": "unaffected", "version": "4.8.1"}]}]}], "published": "2026-06-07T04:16:29.570", "references": [{"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/nas_proto_media_dir_glc_rce/Readme.md", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-11451", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/825563", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/369071", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/369071/cti", "source": "cna@vuldb.com"}, {"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/nas_proto_media_dir_glc_rce/Readme.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: \"In version 4.8.1, before writing media_dir to the FTP configuration command, the code escapes single quotes using escape_single_quote(). The payloads in the report\u2014which rely on closing a single quote, appending commands with a semicolon, and commenting out the tail with #\u2014cannot escape execution under the current code path. We also verified this on a GL\u2011MT3000 device running firmware version 4.8.1 using similar payloads calling the /NAS_API_SET_PROTO_CONFIG interface. Although the interface returned success, the marker file intended to prove command execution was not created; the payload was written into /etc/vsftpd.conf only as ordinary configuration content and did not trigger any shell command execution. Therefore, with the current firmware version and default runtime environment, we could not reproduce the claimed \u201cunauthorized command injection in set_proto_config\u201d.\""}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en GL.iNet GL-MT3000 4.4.5. Esto afecta a la funci\u00f3n snprintf del archivo /cgi-bin/glc del componente Gestor de Protocolo FTP. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento media_dir puede llevar a inyecci\u00f3n de comandos. Es posible lanzar el ataque remotamente. La actualizaci\u00f3n a la versi\u00f3n 4.8.1 solucionar\u00e1 este problema. Deber\u00eda actualizar el componente afectado. El proveedor explica: 'En la versi\u00f3n 4.8.1, antes de escribir media_dir en el comando de configuraci\u00f3n FTP, el c\u00f3digo escapa las comillas simples usando escape_single_quote(). Las cargas \u00fatiles en el informe -que se basan en cerrar una comilla simple, a\u00f1adir comandos con un punto y coma y comentar el resto con #- no pueden escapar la ejecuci\u00f3n bajo la ruta de c\u00f3digo actual. Tambi\u00e9n verificamos esto en un dispositivo GL?MT3000 ejecutando la versi\u00f3n de firmware 4.8.1 usando cargas \u00fatiles similares que llaman a la interfaz /NAS_API_SET_PROTO_CONFIG. Aunque la interfaz devolvi\u00f3 \u00e9xito, el archivo marcador destinado a probar la ejecuci\u00f3n de comandos no fue creado; la carga \u00fatil fue escrita en /etc/vsftpd.conf solo como contenido de configuraci\u00f3n ordinario y no desencaden\u00f3 ninguna ejecuci\u00f3n de comando de shell. Por lo tanto, con la versi\u00f3n de firmware actual y el entorno de ejecuci\u00f3n predeterminado, no pudimos reproducir la 'inyecci\u00f3n de comandos no autorizada en set_proto_config' reclamada.'"}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "cna@vuldb.com"}