CVE-2026-11448

216.73.216.233

· Published 07/06/2026 03:16 · Modified 08/06/2026 16:16

Labels: CVE-2026-11448 2026-06-07 CVE-2026-11448 CWE-74 [email protected]

Essential information

Published: 07/06/2026 03:16
Modified: 08/06/2026 16:16
Author: —
Creator: —
CVSS: 5.1 MEDIUM (v3) 5.1 MEDIUM (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

NVD status

Status: Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
gl.inet / gl-mt3000	`cpe:2.3:a:gl.inet:gl-mt3000:<4.7:::::::*`
gl.inet / gl-mt3000	`cpe:2.3:a:gl.inet:gl-mt3000::4.4.5::::::*`