CVE-2026-12187
HighCVSS 8.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A vulnerability has been detected in GL.iNet GL-MT3000 up to version 4.4.5, affecting an unknown functionality of the file /usr/bin/one_click_upgrade of the Online Firmware Upgrade Handler component. Manipulation of this functionality leads to command injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious security risk to the system. The public disclosure of the exploit increases the likelihood of attacks.
Recommendation
It is recommended to upgrade to version 4.7, which addresses this issue. The affected component should also be updated.
Original NVD description (English source)
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.