CVE-2026-11447

A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfobackend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The attack can be executed remotely. The exploit has been released...

CVE-2026-11450

GL.iNet GL-MT3000 firmware 4.4.5 contains a command injection in the Path Normalization Handler via dlopen in /usr/lib/oui-httpd/rpc/ when processing the dev_name argument. This can be triggered remotely over the network. Upgrading to version 4.7 mitigates the issue by enabling method-level valid...