VulnSocial

CVE-2026-12187General

MEDIUMCVSS 7.4 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Back to dashboard
5.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-74CWE-77

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-14); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-06-14: 2Mentions · 2026-06-15: 2PoC Mentioned / Linked · 2026-06-14: 1Active Exploitation · 2026-06-15: 1Patch / Workaround · 2026-06-14: 1Patch / Workaround · 2026-06-15: 1Technical Details · 2026-06-14: 1Technical Details · 2026-06-15: 106-1406-15
Signal classification4 categories
General
125.0%
Patch
125.0%
Active Exploitation
125.0%
Disclosure
125.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-142
General1Patch1
2026-06-152
Active Exploitation1Disclosure1
Full discourse4 posts
  • VulDB 🛡@vuldb
    Active Exploitation

    Attention, elevated activities detected targeting GL.iNet GL-MT3000 (CVE-2026-12187) https://vuldb.com/vuln/370833/cti

    Post summary

    The post indicates that elevated, likely hostile activity has been identified against GL.iNet GL-MT3000 devices via CVE-2026-12187, but no PoC, exploit code, or patch information is provided.

    0000051
    2.2K followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    High-severity CVE-2026-12187 (CVSS 9.0) impacts GL.iNet GL-MT3000 up to 4.4.5 in the online upgrade component. Check inventory and apply patches promptly. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/cITgK2AjCj

    Post summary

    The tweet alerts on a high‑severity CVE-2026-12187 affecting GL.iNet routers’ upgrade component and urges users to inventory devices and apply available patches promptly.

    0000073
    93 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-12187 (CVSS 8.8) GL[.]iNet GL-MT3000 routers ≤v4.4.5 vulnerable to remote command injection via firmware upgrade handler. Exploit public. Patch to v4.7 immediately. #CVE #Vulnerability #PatchNow https://t.co/0nwuhl69PB

    Post summary

    The tweet announces a high‑severity CVE-2026-12187 enabling remote command injection in GL‑MT3000 routers and urges users to patch to version 4.7 immediately.

    0000055
    44 followersView on X
  • VulDB 🛡@vuldb
    General

    A severe vulnerability was disclosed for GL.iNet GL-MT3000 (CVE-2026-12187) https://vuldb.com/vuln/370833

    Post summary

    A severe vulnerability (CVE-2026-12187) was announced for GL.iNet GL-MT3000, but no further details or exploit information are disclosed.

    0000086
    2.2K followersView on X

Explore more

Back to dashboard