CVE-2026-11449: GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection
A security vulnerability has been detected in GL.iNet GL-MT3000 4.4.5. The impacted element is the function rpcsys of the file /cgi-bin/luci/rpc of the component LuCI JSON-RPC Interface. Such manipulation leads to command injection. The attack may be performed from remote. Upgrading to version 4.8.1 is sufficient to resolve this issue. Upgrading the affected component is advised. The vendor confirms: "The issue discovered by the vulnerability researcher on older firmware versions(4.4.5) has actually been fixed and mitigated in the new version. According to the latest firmware fixes, by default, firmware versions after 4.7.13 do not install LuCI, so this vulnerability cannot be exploited."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GL.iNet GL-MT3000to a version that resolves this vulnerability.Fixed in 4.8.1 - Remove
Remove
LuCIfrom your environment.Uninstall or remove the LuCI (LuCI JSON-RPC Interface) component from affected devices (e.g., ensure /cgi-bin/luci/rpc is not present) if it is not required.
- Compensating control
Use firmware versions newer than 4.7.13 (vendor notes firmware versions after 4.7.13 do not install LuCI by default), or otherwise ensure LuCI is not installed, to prevent exploitation.
- Operational
Identify devices running vulnerable firmware version 4.4.5 and either upgrade them to 4.8.1 or remove/disable LuCI to mitigate the rpc_sys command injection.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11449?
CVE-2026-11449 has a medium severity rating of 6.3.
How do I fix CVE-2026-11449?
To mitigate CVE-2026-11449, upgrade the GL.iNet GL-MT3000 to version 4.8 or later.
What type of vulnerability is CVE-2026-11449?
CVE-2026-11449 is a command injection vulnerability in the GL.iNet GL-MT3000.
Can CVE-2026-11449 be exploited remotely?
Yes, CVE-2026-11449 can be exploited remotely via the LuCI JSON-RPC interface.
What file is affected by CVE-2026-11449?
CVE-2026-11449 affects the /cgi-bin/luci/rpc file on the GL.iNet GL-MT3000.