Command Injection in GL.iNet Router Password Handler

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " The current code escapes single quotes in the password parameter and handles it inside a shell single‑quote context. The payloads in the report, which rely on $() or backticks to trigger command substitution, are not executed under the current code path. We tested on a GL‑MT3000 device running firmware 4.8.1 using similar payloads, and no command‑execution marker file was created."

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11452 is a remote command injection vulnerability affecting GL.iNet GL-MT3000 routers up to version 4.4.5. The vulnerability exists in the SET_USER_PWD handler within the /cgi-bin/glc component, where insufficient input validation on the Password parameter allows attackers to inject arbitrary shell commands. This is critical because GL.iNet routers are widely deployed in enterprise and consumer networks as edge devices, making them attractive targets for initial access and network compromise. An unauthenticated remote attacker can exploit this to gain code execution with the privileges of the web service, potentially leading to full device takeover, lateral movement into connected networks, and persistent access through firmware modification.

Casky's skill mapping across MITRE ATT&CK (Initial Access TA0001, Discovery TA0043, and Execution TA0002) would surface 419 detection patterns for this attack class. Practitioners using Casky would observe suspicious indicators including: malformed password submissions with shell metacharacters or command separators in HTTP requests to /cgi-bin/glc; unexpected process spawning or system command execution originating from the web service process; network reconnaissance commands (whoami, ifconfig, iptables) executed post-exploitation; and abnormal file modifications to /etc/passwd or firmware directories. The platform's Claude-powered extended reasoning would correlate these disparate signals—combining CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-77 (Improper Neutralization of Special Elements used in a Command) patterns—to identify command injection attack chains even when partially obfuscated or staged across multiple requests.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11452.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-11452

Casky has 419 skills that investigate the attack patterns behind CVE-2026-11452. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn