CVE-2026-11448

GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection

State: Published
Severity: 5.1 Medium
Published: Jun 7, 2026
Updated: Jun 8, 2026
Reserved: Jun 6, 2026

Description

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	4.7 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	5.8 Medium	AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
GL-MT3000GL.iNet	4.4.0Affected 4.4.1Affected 4.4.2Affected 4.4.3Affected 4.4.4Affected 4.4.5Affected 4.7Not affected

References

VDB-369068 | GL.iNet GL-MT3000 Minidlna Service rpc realpath command injectionvdb-entrytechnical-description
VDB-369068 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-11448 | CVE Analysis and Reportthird-party-advisory
Submit #825212 | GL.iNet GL-MT3000 4.4.5 Command Injectionthird-party-advisory
https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/minidlna_db_dir_uci_rcerelated

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.