PT-2026-49110 · Gl.Inet · Gl-Mt3000

Strforexc · CVE-2026-12187 · Published 2026-06-14 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.7

Description Remote command injection is possible within the Online Firmware Upgrade Handler component. The issue resides in the /usr/bin/one click upgrade file, where improper handling of functionality allows an attacker to execute arbitrary commands remotely.

Recommendations Update to version 4.7.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-12187

Affected Products

Gl-Mt3000

References · 14

• 🔥 https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/upgrade_online_url · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12187 · Security Note
• https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tar · Patch
• https://vuldb.com/submit/815654 · Note
• https://twitter.com/vuldb/status/2066645968859402436 · Twitter Post
• https://vuldb.com/vuln/370833 · Note
• https://twitter.com/vuldb/status/2066048890877698301 · Twitter Post
• https://t.me/CSIRT_italia/3646 · Telegram Post
• https://twitter.com/ADKCyber/status/2066310294985687149 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2066300983034912790 · Twitter Post
• https://t.me/CVEtracker/56813 · Telegram Post
• https://t.me/cveNotify/220172 · Telegram Post
• https://vuldb.com/cve/CVE-2026-12187 · Note
• https://vuldb.com/vuln/370833/cti · Note