CVE-2026-11452

Executive Summary

CVE-2026-11452 is a command injection vulnerability in the GL.iNet GL-MT3000 router, affecting firmware versions up to 4.4.5. The flaw resides in the SET_USER_PWD handler within the /cgi-bin/glc file, specifically in the function FUN_0042e200. An attacker can remotely manipulate the Password argument to inject arbitrary commands, potentially leading to full device compromise. The vendor has released firmware version 4.8.1 which addresses the issue by escaping single quotes and handling the password inside a shell single‑quote context, thereby neutralizing common command substitution payloads. Despite the vendor’s assertion, the vulnerability is classified as unpatched in the original NVD data, and the EPSS score is 0.0%, indicating low exploitation activity. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a hardware device (GL.iNet GL-MT3000 router). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full read access to device data.
• Integrity Impact: High (I:H) – full write access to device configuration.
• Availability Impact: High (A:H) – potential denial of service or device bricking.

Threat Level: High. Remote unauthenticated command injection in a network device can lead to complete takeover, lateral movement, and persistent access.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the SET_USER_PWD handler. The Password argument is passed to a shell command without proper sanitization. The vendor’s fix escapes single quotes and wraps the password in a single‑quote context, which prevents command substitution via $() or backticks. However, the original code likely concatenated the password directly into a shell command string, allowing an attacker to break out of the intended context.

Attack Flow:

1. Attacker sends a crafted HTTP POST request to /cgi-bin/glc with a malicious Password parameter.
2. The FUN_0042e200 function constructs a shell command using the unsanitized password.
3. The injected command (e.g., ; id > /tmp/out) is executed with root privileges.
4. Attacker gains remote code execution on the router.

Vendor’s Explanation: The vendor claims that the current code (in 4.8.1) escapes single quotes and handles the password inside a shell single‑quote context, so payloads relying on $() or backticks are not executed. However, the NVD data still lists the vulnerability as unpatched, and the vendor’s statement may not cover all injection vectors (e.g., newline injection or other shell metacharacters).

Vulnerable vs. Patched Code

Vulnerable Code (firmware <= 4.4.5):

// Pseudocode for FUN_0042e200
void FUN_0042e200(char *password) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "echo %s > /tmp/pwd", password);
    system(cmd);
}

The password is directly inserted into the command string without escaping.

Patched Code (firmware 4.8.1):

// Pseudocode for patched FUN_0042e200
void FUN_0042e200(char *password) {
    char escaped[256];
    // Escape single quotes
    for (int i = 0; password[i] != '\0'; i++) {
        if (password[i] == '\'') {
            strcat(escaped, "'\\''");
        } else {
            strncat(escaped, &password[i], 1);
        }
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "echo '%s' > /tmp/pwd", escaped);
    system(cmd);
}

The password is now wrapped in single quotes, and any single quote within the password is escaped as '\'', preventing breakout.

Exploitation & Lab Setup

Red Team

Prerequisites:

• GL.iNet GL-MT3000 router with firmware <= 4.4.5.
• Network access to the router’s web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify the target router (e.g., via Shodan dork http.title:"GL-MT3000").
2. Send a crafted POST request to /cgi-bin/glc with a malicious Password parameter.
3. Example payload using command substitution (if not patched):

   curl -X POST http://<target>/cgi-bin/glc \
     -d "action=SET_USER_PWD&Password=test'; id > /tmp/out; echo '"
   

4. Verify execution by accessing /tmp/out via another endpoint or by observing outbound connections.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor HTTP POST requests to /cgi-bin/glc with suspicious Password parameters containing shell metacharacters (;, |, $, `, \n).
• Look for outbound connections from the router to unknown IPs after a password change attempt.
• Check for unexpected files in /tmp/ (e.g., /tmp/out, /tmp/pwned).

Hunting:

• Search logs for SET_USER_PWD action with unusual password lengths or characters.
• Use network flow data to detect anomalous traffic from the router.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /cgi-bin/glc with Password parameter containing shell metacharacters.
  • Outbound connections from the router to unknown IPs on non-standard ports.
• File System:
  • Unexpected files in /tmp/ (e.g., /tmp/out, /tmp/pwned, /tmp/revshell).
  • Modified /etc/passwd or /etc/shadow if attacker added backdoor accounts.
• Process:
  • Unusual processes spawned by httpd or cgi-bin handlers.
  • Reverse shell processes (e.g., /bin/sh -c).

Detection Engineering

YARA Rule

rule CVE_2026_11452_Command_Injection {
    meta:
        description = "Detects command injection attempts against GL.iNet GL-MT3000 SET_USER_PWD handler"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-11452"
    strings:
        $cmd_inject = /Password=.*[;&|`$()]/
        $path = "/cgi-bin/glc"
    condition:
        $path and $cmd_inject
}

Sigma Rule

title: CVE-2026-11452 Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/glc with suspicious Password parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/glc'
        cs-uri-query|contains: 'Password='
    filter:
        cs-uri-query|re: 'Password=[a-zA-Z0-9]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate password changes with complex but safe characters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11452 GL.iNet GL-MT3000 Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/glc"; http_uri; content:"Password="; http_client_body; pcre:"/Password=[^&]*[;&|`$()]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to version 4.8.1 or later.
2. If upgrade is not possible, restrict network access to the router’s web interface (e.g., via firewall rules or VPN).
3. Disable remote management if not required.

Long-term Measures:

• Implement input validation and output encoding for all CGI parameters.
• Use parameterized commands or safe APIs instead of shell execution.
• Conduct regular firmware updates and vulnerability scanning.

Workarounds:

• Block HTTP POST requests to /cgi-bin/glc at the perimeter firewall.
• Monitor logs for exploitation attempts using the provided detection rules.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert