Vulnerability in CVE-2026-12187 (CVSS 8.8)

Summary

vulnerability in CVE-2026-12187 (CVE-2026-12187). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability tracked as CVE-2026-12187 has been found in CVE-2026-12187.
Successful exploitation can lead to full system takeover. CVSS score: 8.8/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "CVE-2026-12187 CVE-2026-12187" on the vendor's site.

CVE-2026-12187 (CVE-2026-12187) — CWE-74 / CVSS v3 8.8
Attack vector: remote (network-reachable) / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

GL.iNet GL-MT3000におけるコマンドインジェクションの脆弱性です。

📍 Affected scope

オンラインファームウェアアップグレードハンドラのファイル/usr/bin/one_click_upgrade

🔥 Severity

リモートからのコマンドインジェクションが可能で、悪用されるリスクが高いです。

🔧 How to fix

バージョン4.7にアップグレードすることが推奨されます。

🛡️ Workaround

情報なし

🔍 Detection

特定バージョン(4.4.5以下)の使用を確認し、アップグレードの実施を検討する。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Vulnerability in CVE-2026-12187 (CVE-2026-12187)

Summary

Original description

AI summary

Response actions

References