Vulnerability Description
A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component. The vendor confirms: " From version 4.7 onward, we have enabled method‑level validation at the HTTP /rpc layer. nas‑web.eject_disk is no longer in the whitelist of allowed methods. Consequently, directly calling eject_disk through the default /rpc endpoint returns Invalid params, preventing entry into subsequent dangerous functions and blocking the remote exploit chain described in the report."
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_di
- https://vuldb.com/cve/CVE-2026-11450
- https://vuldb.com/submit/825536
- https://vuldb.com/vuln/369070
- https://vuldb.com/vuln/369070/cti
- https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/nas_eject_di
FAQ
What is CVE-2026-11450?
CVE-2026-11450 is a vulnerability with a CVSS score of 7.3 (HIGH). A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation ...
How severe is CVE-2026-11450?
CVE-2026-11450 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-11450?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.