CVE-2026-12186

GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection

State: Published
Severity: 8.7 High
Published: Jun 14, 2026
Updated: Jun 15, 2026
Reserved: Jun 14, 2026

Description

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
GL-MT3000GL.iNet	4.4.0Affected 4.4.1Affected 4.4.2Affected 4.4.3Affected 4.4.4Affected 4.4.5Affected 4.7Not affected

References

VDB-370832 | GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injectionvdb-entrytechnical-description
VDB-370832 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-12186 | CVE Analysis and Reportthird-party-advisory
Submit #815579 | GL.iNet GL-MT3000 mt3000-4.4.5 Command Injectionthird-party-advisory
https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/tor_set_config/Readme.mdexploit
https://fw.gl-inet.com/firmware/mt3000/release/mt3000-4.8.1-0819-1755615825.tarpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.