CVE-2026-12186: GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection

Synopsis

A command injection vulnerability affects the Tor Proxy Service Configuration Handler in GL.iNet GL-MT3000 firmware versions up to 4.4.5, specifically in the replace_country function of the /usr/lib/oui-httpd/rpc/tor library. The flaw is reachable over the network and requires a low-privilege account; no victim interaction is needed. Successful exploitation gives an attacker full read, write, and execution control over the device. A patched-image rebuild at version 4.7 is available on HarborGuard for environments running an affected firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's Tor Proxy Service Configuration Handler over the network; no local or physical access is required.

• AuthenticationRequired

  A low-privilege account on the device is sufficient to trigger the vulnerable replace_country function; no admin credentials are needed.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can send a crafted request directly without involving any other party.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, special memory layout, or environmental pre-conditions are required to trigger the injection.

Blast Radius

• Reads sensitive files and credentials stored on the device, including any secrets accessible to the web service process.
• Writes or overwrites arbitrary files on the device filesystem, allowing persistent backdoors or configuration tampering.
• Executes arbitrary OS commands with the privileges of the oui-httpd service, enabling full device takeover.
• Crashes or disrupts the Tor proxy service, cutting off anonymized traffic routing for any workloads depending on the device.