Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities found for MT3000 by GL.iNet
CVE-2026-18585 (GCVE-0-2026-18585)
Vulnerability from nvd – Published: 2026-08-03 05:15 – Updated: 2026-08-03 13:21
VLAI
EPSS
VEX
Title
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow
Summary
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 13:20 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385414 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385414/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18585 | third-party-advisory |
| https://vuldb.com/submit/849290 | third-party-advisory |
| https://github.com/gl-inet/CVE-issues/blob/main/4… | related |
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| GL.iNet | MT3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT6000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE9300 |
Affected:
20260707
cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE3600 |
Affected:
20260707
cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3600BE |
Affected:
20260707
cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:* |
|
| GL.iNet | E5800 |
Affected:
20260707
cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE6500 |
Affected:
20260707
cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT5000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | XE3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT2500 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:20:50.996638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T13:21:10.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT6000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE9300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE3600",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT3600BE",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "E5800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE6500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT5000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "X3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "XE3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT2500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GLiNet (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T05:15:07.982Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385414 | GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385414"
},
{
"name": "VDB-385414 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385414/cti"
},
{
"name": "CVE-2026-18585 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18585"
},
{
"name": "Submit #849290 | GL.iNet Router 4.8.x Cache overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/849290"
},
{
"tags": [
"related"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T21:29:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18585",
"datePublished": "2026-08-03T05:15:07.982Z",
"dateReserved": "2026-08-02T19:24:01.254Z",
"dateUpdated": "2026-08-03T13:21:10.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11505 (GCVE-0-2026-11505)
Vulnerability from nvd – Published: 2026-06-08 10:15 – Updated: 2026-06-08 13:25
VLAI
EPSS
VEX
Title
GL.iNet XE3000 glnassys hard-coded key
Summary
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key
. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-08 13:25 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/369125 | vdb-entry |
| https://vuldb.com/vuln/369125/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-11505 | third-party-advisory |
| https://vuldb.com/submit/835698 | third-party-advisory |
| https://github.com/gl-inet/CVE-issues/blob/main/4… | related |
| https://cloud-static-test.gl-inet.cn/security/ope… | patch |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| GL.iNet | A1300 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:* |
|
| GL.iNet | AX1800 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | AXT1800 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT2500 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT6000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | XE3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T13:25:39.138620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T13:25:49.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "A1300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "AX1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "AXT1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT2500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT6000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "X3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "XE3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GLiNet (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key\r . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T10:15:09.229Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-369125 | GL.iNet XE3000 glnassys hard-coded key",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/369125"
},
{
"name": "VDB-369125 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/369125/cti"
},
{
"name": "CVE-2026-11505 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-11505"
},
{
"name": "Submit #835698 | GL.iNet Router 4.8.x unauthorized",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/835698"
},
{
"tags": [
"related"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md"
},
{
"tags": [
"patch"
],
"url": "https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-07T16:11:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet XE3000 glnassys hard-coded key"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-11505",
"datePublished": "2026-06-08T10:15:09.229Z",
"dateReserved": "2026-06-07T14:06:05.114Z",
"dateUpdated": "2026-06-08T13:25:49.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11406 (GCVE-0-2026-11406)
Vulnerability from nvd – Published: 2026-06-06 09:15 – Updated: 2026-06-08 16:27
VLAI
EPSS
VEX
Title
GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection
Summary
A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-08 16:27 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368966 | vdb-entry |
| https://vuldb.com/vuln/368966/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-11406 | third-party-advisory |
| https://vuldb.com/submit/820049 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/tree/main/GL… | exploit |
| https://fw.gl-inet.cn/firmware/mt3000/testing/mt3… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11406",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T16:27:49.061711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T16:27:56.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"OpenVPN Client Import Workflow"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
},
{
"status": "unaffected",
"version": "4.9.0_beta3-1012-0513-1778656146"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "strforexc (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: \"This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T09:15:12.019Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368966 | GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/368966"
},
{
"name": "VDB-368966 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368966/cti"
},
{
"name": "CVE-2026-11406 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-11406"
},
{
"name": "Submit #820049 | GL.iNet MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/820049"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/ovpn_client_import"
},
{
"tags": [
"patch"
],
"url": "https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-05T20:31:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-11406",
"datePublished": "2026-06-06T09:15:12.019Z",
"dateReserved": "2026-06-05T18:26:22.054Z",
"dateUpdated": "2026-06-08T16:27:56.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18585 (GCVE-0-2026-18585)
Vulnerability from cvelistv5 – Published: 2026-08-03 05:15 – Updated: 2026-08-03 13:21
VLAI
EPSS
VEX
Title
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow
Summary
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 13:20 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385414 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385414/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18585 | third-party-advisory |
| https://vuldb.com/submit/849290 | third-party-advisory |
| https://github.com/gl-inet/CVE-issues/blob/main/4… | related |
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| GL.iNet | MT3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT6000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE9300 |
Affected:
20260707
cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE3600 |
Affected:
20260707
cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3600BE |
Affected:
20260707
cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:* |
|
| GL.iNet | E5800 |
Affected:
20260707
cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE6500 |
Affected:
20260707
cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT5000 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | XE3000 |
Affected:
20260707
cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT2500 |
Affected:
20260707
cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:20:50.996638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T13:21:10.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT6000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE9300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE3600",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT3600BE",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "E5800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "BE6500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT5000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "X3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "XE3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*"
],
"modules": [
"APPS-NAS Module"
],
"product": "MT2500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "20260707"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GLiNet (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T05:15:07.982Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385414 | GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385414"
},
{
"name": "VDB-385414 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385414/cti"
},
{
"name": "CVE-2026-18585 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18585"
},
{
"name": "Submit #849290 | GL.iNet Router 4.8.x Cache overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/849290"
},
{
"tags": [
"related"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T21:29:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18585",
"datePublished": "2026-08-03T05:15:07.982Z",
"dateReserved": "2026-08-02T19:24:01.254Z",
"dateUpdated": "2026-08-03T13:21:10.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11505 (GCVE-0-2026-11505)
Vulnerability from cvelistv5 – Published: 2026-06-08 10:15 – Updated: 2026-06-08 13:25
VLAI
EPSS
VEX
Title
GL.iNet XE3000 glnassys hard-coded key
Summary
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key
. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-08 13:25 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/369125 | vdb-entry |
| https://vuldb.com/vuln/369125/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-11505 | third-party-advisory |
| https://vuldb.com/submit/835698 | third-party-advisory |
| https://github.com/gl-inet/CVE-issues/blob/main/4… | related |
| https://cloud-static-test.gl-inet.cn/security/ope… | patch |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| GL.iNet | A1300 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:* |
|
| GL.iNet | AX1800 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | AXT1800 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT2500 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT6000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | XE3000 |
Affected:
4.8.*
Unaffected: 4.9.0 cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T13:25:39.138620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T13:25:49.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "A1300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "AX1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "AXT1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT2500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "MT6000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "X3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*"
],
"modules": [
"glnassys"
],
"product": "XE3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.8.*"
},
{
"status": "unaffected",
"version": "4.9.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GLiNet (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key\r . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T10:15:09.229Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-369125 | GL.iNet XE3000 glnassys hard-coded key",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/369125"
},
{
"name": "VDB-369125 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/369125/cti"
},
{
"name": "CVE-2026-11505 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-11505"
},
{
"name": "Submit #835698 | GL.iNet Router 4.8.x unauthorized",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/835698"
},
{
"tags": [
"related"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md"
},
{
"tags": [
"patch"
],
"url": "https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-07T16:11:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet XE3000 glnassys hard-coded key"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-11505",
"datePublished": "2026-06-08T10:15:09.229Z",
"dateReserved": "2026-06-07T14:06:05.114Z",
"dateUpdated": "2026-06-08T13:25:49.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11406 (GCVE-0-2026-11406)
Vulnerability from cvelistv5 – Published: 2026-06-06 09:15 – Updated: 2026-06-08 16:27
VLAI
EPSS
VEX
Title
GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection
Summary
A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-08 16:27 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368966 | vdb-entry |
| https://vuldb.com/vuln/368966/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-11406 | third-party-advisory |
| https://vuldb.com/submit/820049 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/tree/main/GL… | exploit |
| https://fw.gl-inet.cn/firmware/mt3000/testing/mt3… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11406",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T16:27:49.061711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T16:27:56.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"OpenVPN Client Import Workflow"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
},
{
"status": "unaffected",
"version": "4.9.0_beta3-1012-0513-1778656146"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "strforexc (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: \"This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T09:15:12.019Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368966 | GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/368966"
},
{
"name": "VDB-368966 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368966/cti"
},
{
"name": "CVE-2026-11406 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-11406"
},
{
"name": "Submit #820049 | GL.iNet MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/820049"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/ovpn_client_import"
},
{
"tags": [
"patch"
],
"url": "https://fw.gl-inet.cn/firmware/mt3000/testing/mt3000-4.9.0_beta3-1012-0513-1778656146.tar"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-05T20:31:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-11406",
"datePublished": "2026-06-06T09:15:12.019Z",
"dateReserved": "2026-06-05T18:26:22.054Z",
"dateUpdated": "2026-06-08T16:27:56.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}