GL.iNet Router FTP Handler Command Injection Flaw

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version 4.8.1, before writing media_dir to the FTP configuration command, the code escapes single quotes using escape_single_quote(). The payloads in the report—which rely on closing a single quote, appending commands with a semicolon, and commenting out the tail with #—cannot escape execution under the current code path. We also verified this on a GL‑MT3000 device running firmware version 4.8.1 using similar payloads calling the /NAS_API_SET_PROTO_CONFIG interface. Although the interface returned success, the marker file intended to prove command execution was not created; the payload was written in

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11451 is a command injection vulnerability in GL.iNet GL-MT3000 routers (versions prior to 4.8.1) affecting the FTP Protocol Handler component. An attacker can manipulate the media_dir parameter in the /cgi-bin/glc endpoint to inject arbitrary commands, which are then executed through the snprintf function without proper sanitization. This vulnerability carries a CVSS score of 7.3 (high severity) and is remotely exploitable without authentication, making it particularly dangerous for organizations deploying these routers in edge network positions, remote offices, or IoT infrastructure. Small office/home office (SOHO) users and enterprise branch offices relying on GL.iNet devices for network management face immediate risk of system compromise, lateral movement, and data exfiltration.

Casky's 419 matching skills detect this attack pattern by analyzing the underlying MITRE ATT&CK techniques: TA0001 (Reconnaissance) for initial probing of the vulnerable endpoint, TA0043 (Reconnaissance) for fingerprinting device versions, and TA0002 (Execution) for command injection payload delivery. Practitioners using Casky would identify suspicious HTTP requests to /cgi-bin/glc with encoded or obfuscated media_dir parameters, particularly those containing shell metacharacters (pipes, semicolons, backticks) or quote-escaping attempts. Claude's extended reasoning capabilities correlate these indicators with FTP configuration patterns and snprintf exploitation signatures, surfacing behavioral anomalies that distinguish legitimate configuration changes from injection attempts targeting the unescaped parameter handling flaw addressed in version 4.8.1.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11451.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-11451

Casky has 419 skills that investigate the attack patterns behind CVE-2026-11451. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn