CVE-2026-11451

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version 4.8.1, before writing media_dir to the FTP configuration command, the code escapes single quotes using escape_single_quote(). The payloads in the report—which rely on closing a single quote, appending commands with a semicolon, and commenting out the tail with #—cannot escape execution under the current code path. We also verified this on a GL‑MT3000 device running firmware version 4.8.1 using similar payloads calling the /NAS_API_SET_PROTO_CONFIG interface. Although the interface returned success, the marker file intended to prove command execution was not created; the payload was written into /etc/vsftpd.conf only as ordinary configuration content and did not trigger any shell command execution. Therefore, with the current firmware version and default runtime environment, we could not reproduce the claimed “unauthorized command injection in set_proto_config”."

• CWE-74
• CWE-77

• https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/nas_proto_media_dir_glc_rce/Readme.md
• https://vuldb.com/cve/CVE-2026-11451
• https://vuldb.com/submit/825563
• https://vuldb.com/vuln/369071
• https://vuldb.com/vuln/369071/cti
• https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/nas_proto_media_dir_glc_rce/Readme.md

Published

Jun 7, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11443Allegra downloadAttachment Cross-Site Scripting Authenticati…4.6
• CVE-2026-11447A security flaw has been discovered in GL.iNet GL-MT3000 up …6.3
• CVE-2026-11448A weakness has been identified in GL.iNet GL-MT3000 up to 4.…5.1
• CVE-2026-11449A security vulnerability has been detected in GL.iNet GL-MT3…6.3
• CVE-2026-1145A flaw has been found in quickjs-ng quickjs up to 0.11.0. Af…8.8
• CVE-2026-11450A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. Thi…7.3
• CVE-2026-11452A vulnerability has been found in GL.iNet GL-MT3000 up to 4.…7.3
• CVE-2026-11453A vulnerability was found in Tiobon Employee Self-Service Sy…6.3
• CVE-2026-11454The Groundhogg — CRM, Newsletters, and Marketing Automation …6.5
• CVE-2026-11455A vulnerability was determined in FoundationAgents MetaGPT u…5
• CVE-2026-11456A vulnerability was identified in Chanjet CRM 1.0. This affe…7.3
• CVE-2026-11457A security flaw has been discovered in erzhongxmu JeeWMS up …7.3