PT-2026-47168 · Gl.Inet · Gl-Mt3000

Strforexc · CVE-2026-11447 · Published 2026-06-07 · Updated 2026-06-07

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.7

Description A remote command injection flaw exists in the MTK Backend component within the iwinfo backend() function of the iwinfo.so file. The issue occurs when the device argument is manipulated, allowing an attacker to execute arbitrary commands remotely.

Recommendations Update to version 4.7. Upgrade the affected MTK Backend component.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-11447

Affected Products

Gl-Mt3000

References · 10

• 🔥 https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/iwinfo_scan_ubus_rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11447 · Security Note
• https://t.me/CVEtracker/56082 · Telegram Post
• https://t.me/cveNotify/166404 · Telegram Post
• https://vuldb.com/vuln/369067 · Note
• https://twitter.com/NewsNerdie/status/2063622608801722880 · Twitter Post
• https://vuldb.com/submit/824951 · Note
• https://vuldb.com/vuln/369067/cti · Note
• https://twitter.com/VulmonFeeds/status/2063449975246213256 · Twitter Post
• https://vuldb.com/cve/CVE-2026-11447 · Note