CVE-2026-11448CWE-74CWE-77

GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection

Medium · published June 7, 2026

CVSS v4.0
5.1
EPSS
2%
Percentile
75.3
In the wild
Unconfirmed
What it is

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor confirms: "Starting from version 4.7, SDK has added global protection to intercept malicious injection".

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.01582 · 75.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-06-07T02:00Z
EPSS history
Timeline
  • 07 JUN 02:00Z
    GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection
    cvelistv5