Loading vulnerability…
CVE-2026-11451 is a command injection flaw affecting GL.iNet GL-MT3000 firmware version 4.4.5. According to the provided content, the issue is in the FTP Protocol Handler, specifically in the /cgi-bin/glc component and the handling of the media_dir argument in the /NAS_API_SET_PROTO_CONFIG interface. The vulnerable code path involves the use of snprintf while constructing an FTP configuration command. An attacker who can manipulate media_dir may be able to inject shell metacharacters and append unintended commands, resulting in command execution. The report indicates the injection technique relied on terminating a single-quoted context, appending commands with a semicolon, and commenting out the remainder with #. The vendor states that firmware 4.8.1 escapes single quotes with escape_single_quote() before writing media_dir, and that they could not reproduce command execution on 4.8.1 under the default runtime environment.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small standalone Python proof-of-concept exploit and a README. The exploit targets three unauthenticated command injection vulnerabilities in GL.iNet GL-MT3000 (Beryl AX) firmware <= 4.4.5, all reachable through the /cgi-bin/glc web CGI dispatcher. The script is not part of a larger exploitation framework. Structure: README.md documents the CVEs, affected versions, usage examples, and prerequisites. poc.py is the sole executable component and serves as the entry point. It uses Python standard-library modules only (json, ssl, urllib, argparse, time, shlex). Core behavior: poc.py builds JSON POST requests to /cgi-bin/glc with object set to nas-web and varying method names. It disables TLS certificate validation, allowing exploitation over HTTPS against devices with self-signed certs. The helper glc_call() centralizes request construction and response handling. Exploit capabilities by CVE: CVE-2026-11450 abuses the eject_disk_do1 method by crafting a long dev_name value that appends a shell command substitution payload $(cmd>outfile), relying on a buffer-length mismatch between an access() check and a later system() call. CVE-2026-11451 abuses set_proto_config by injecting shell metacharacters into the FTP media_dir parameter using a single-quote break-out sequence (/x';cmd>outfile 2>&1;#). CVE-2026-11452 abuses set_user_pwd by first enabling/starting NAS services, enumerating existing NAS users with get_user_list, then injecting a command substitution payload into the password field for a selected user. Operational result: successful exploitation yields arbitrary command execution on the router, with output redirected to files on the target filesystem for manual verification. The script supports running one CVE or all three in sequence. Because it includes working payloads and execution logic but no advanced operator tooling, it is best classified as an operational PoC rather than a detection script or weaponized framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.