CVE-2026-12187: GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection

Synopsis

This is a command injection vulnerability in the GL.iNet GL-MT3000 router firmware, specifically in the Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) on versions up to 4.4.5. The flaw is reachable over the network and requires only a low-privilege account, meaning any authenticated user can trigger it. Successful exploitation gives an attacker full control over the device, including reading, modifying, and disrupting its operation. A patched-image rebuild at version 4.7 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's firmware upgrade interface over the network; no physical or local access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrator credentials to reach the vulnerable handler.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the injection without any action from a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads sensitive data stored on the device, including credentials, configuration, and network topology details.
• Modifies device configuration or firmware state, enabling persistent backdoors or traffic interception.
• Crashes or disrupts the firmware upgrade process and connected network services, taking the device offline.
• Executes arbitrary OS commands as the process owner, effectively giving full shell-level control of the router.