Gl Inet
Monthly
Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the `remove_rule` RPC endpoint. The vulnerable parameter `args.id` in `/usr/share/gl-ngx/oui-rpc.lua` is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation.
Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis.
Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment.
Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device.
Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk.
Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis.
Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface.
Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required.
Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation.
Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk.
Command injection in the GL.iNet GL-MT3000 travel router's Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) allows authenticated remote attackers to execute arbitrary OS commands on devices running firmware up to 4.4.5. Publicly available exploit code exists on GitHub, and the issue is fixed in firmware 4.7 (with 4.8.1 currently published by the vendor). No CISA KEV listing has been confirmed, but the combination of a published PoC and an internet-exposable management interface raises the practical risk above the headline CVSS score.
Authenticated command injection in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5) lets remote attackers with low-privileged access execute arbitrary OS commands via the replace_country function in the Tor Proxy Service configuration handler. Publicly available exploit code exists for the flaw, and the vendor has shipped a fix; no public exploit identified at time of analysis as actively exploited in the wild.
Remote authentication bypass in GL.iNet GL-RM1, GL-RM10, GL-RM10RC, and GL-RM1PE versions up to 1.8.1 allows authenticated remote attackers with high privileges to manipulate the Factory Reset Handler component, resulting in improper authentication controls. The vulnerability requires high attack complexity and is difficult to exploit but enables unauthorized access to sensitive device functionality. A vendor-released patch addressing this issue is available in version 1.8.2.
Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.
Physical UART access on GL-iNet Comet (GL-RM1) KVM grants unauthenticated attackers complete device control with high confidentiality, integrity, and availability impact. This hardware-level authentication bypass (CWE-306) requires disassembling the device and connecting to internal serial pins, significantly limiting practical exploitation despite the 7.0 CVSS score. EPSS probability is very low (0.03%, 7th percentile), consistent with the physical access requirement. No active exploitation confirmed; CISA CG reported this vulnerability alongside vendor firmware version 1.8.2 reference, suggesting patch availability.
Firmware update integrity checks in GL-iNet Comet (GL-RM1) KVM can be bypassed by attackers positioned on the network path or who have compromised the update server. The device relies solely on MD5 hash verification, which an attacker can recalculate after modifying the firmware image. Successful exploitation allows installation of malicious firmware, granting persistent control over the KVM device and potentially compromising all systems managed through it. EPSS score is minimal (0.01%), indicating low likelihood of mass exploitation, but CVSS 7.0 and specialized targeting of KVM infrastructure suggest high impact for targeted attacks. No public exploit code identified at time of analysis.
GL-iNet GL-AR300M16 v4.3.11 has a command injection in the set_config function, adding to the growing list of injection vulnerabilities in this device. This is the fourth distinct command injection CVE for this router model.
GL-iNet GL-AR300M16 v4.3.11 contains another command injection vulnerability, this time via the module parameter in the M.get_system_log function. Part of a series of command injection flaws in this router model.
SQL injection in GL-iNet GL-AR300M16 firmware v4.3.11 allows authenticated attackers to execute arbitrary database commands through the add_group() function via crafted HTTP requests. The vulnerability affects all installations of the affected firmware version and requires valid credentials to exploit. No patch is currently available to remediate this high-severity flaw.
GL-iNet GL-AR300M16 v4.3.11 has multiple command injection vulnerabilities in the set_upgrade function through seven different parameters. Each parameter provides an independent code execution vector on the router.
GL-iNet GL-AR300M16 router (v4.3.11) is vulnerable to command injection through the string port parameter in the enable_echo_server function. Unauthenticated attackers can execute arbitrary commands on the router.
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 52.3%.
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism.
OS command injection in GL.iNet BE9300 and MT6000 router firmware 4.8.x allows remote low-privileged attackers to execute arbitrary operating system commands via unsanitized dest_port and dest_ip arguments in the Firewall-management RPC component. The vendor has confirmed the vulnerability through their CVE issues GitHub repository and released a fix in firmware version 4.9.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute arbitrary shell commands via the Wi-Fi Timer Power-Schedule feature by manipulating the switch_power or restore_power arguments. The vendor has independently confirmed the vulnerability exists. A public write-up exists in the vendor's own CVE issues repository describing the attack as a cron-based RCE path, and no public exploit with KEV listing has been identified at time of analysis. The CVSS 4.0 score of 5.3 (with PR:L) reflects that low-privilege authentication is required, but the real-world impact of arbitrary command execution on a network router warrants elevated attention beyond what the score conveys.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Improper authorization in GL.iNet's eSIM LPA API allows adjacent-network unauthenticated attackers to bypass nginx proxy controls on six cellular router models, gaining unauthorized access to eSIM management functions. Affected devices include the E5800, E750, X2000, X3000, XE3000, and XE300 running firmware up to 20260707. The GitHub advisory title explicitly frames this as 'Unauthenticated access to eSIM LPA API via nginx proxy bypass,' indicating the authorization enforcement failure lies in how nginx proxies requests to the /sdk/v1 endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models running firmware 4.8.x enables a low-privileged remote attacker to exploit a static authentication token and potentially execute unauthorized commands against the NAS subsystem. The vulnerability is rooted in CWE-321 (Use of Hard-coded Cryptographic Key), where the firmware embeds a fixed authentication secret that cannot be rotated by users or administrators. No public exploit identified at time of analysis, and the vendor has released firmware 4.9.0 as a fix.
Command injection in GL.iNet GL-MT3000 routers running firmware up to 4.4.5 allows remote attackers to inject shell commands through the Password argument of the SET_USER_PWD handler in /cgi-bin/glc (function FUN_0042e200). The flaw is network-reachable with low complexity, but no public exploit is identified at time of analysis and the vendor disputes practical exploitability, stating that single-quote escaping in the shell context blocks the reported $() and backtick payloads.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to inject shell commands via the media_dir parameter handled by the snprintf call in /cgi-bin/glc's FTP protocol handler. The CVSS vector indicates network-reachable, unauthenticated exploitation with low complexity, and publicly available exploit code exists on GitHub (StrTzz123/iot_vul). The vendor has issued firmware 4.8.1 and disputes reproducibility on the patched build, stating that escape_single_quote() now sanitizes the input before it reaches the FTP configuration write path.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to execute arbitrary OS commands by manipulating the dev_name argument passed to the dlopen function in the /usr/lib/oui-httpd/rpc/ Path Normalization Handler, reachable via the nas-web.eject_disk RPC method. Publicly available exploit code exists on GitHub demonstrating the chain. No CISA KEV listing and EPSS data was not provided, but the network-reachable, no-authentication CVSS vector combined with public PoC makes this a meaningful risk for exposed devices.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows a remote, low-privileged attacker to execute arbitrary OS commands via the `rpc_sys` function exposed through the LuCI JSON-RPC interface at `/cgi-bin/luci/rpc`. The vendor has confirmed the vulnerability and released a fix in firmware 4.8.1; critically, versions after 4.7.13 no longer install LuCI by default, eliminating the attack surface for most current deployments. Publicly available exploit code exists in a GitHub repository, though no active exploitation has been confirmed by CISA KEV.
Remote command injection in GL.iNet GL-MT3000 firmware versions up to 4.4.5 enables a network-reachable, high-privilege attacker to execute arbitrary OS commands through the Minidlna service's /rpc endpoint by manipulating the kube.set argument of the realpath function. The vendor has confirmed the vulnerability and released a fix in firmware version 4.7, citing SDK-level global sanitization as the remediation. Publicly available exploit code exists in a GitHub proof-of-concept repository (StrTzz123/iot_vul), though no active exploitation has been confirmed by CISA KEV at time of analysis.
Command injection in GL.iNet GL-MT3000 router firmware (versions up to 4.4.5) allows a low-privileged remote attacker to execute arbitrary OS commands by manipulating the 'device' argument passed to the iwinfo_backend function in iwinfo.so. A public proof-of-concept exploit is available on GitHub, raising the realistic likelihood of opportunistic abuse. The vendor has confirmed the issue and released firmware 4.7 with a global injection interception protection in the SDK.
Command injection in GL.iNet MT3000 routers running firmware up to version 4.4.5 allows authenticated remote attackers to execute arbitrary OS commands by supplying a crafted OpenVPN configuration file through the device's OpenVPN Client Import Workflow. The shell script ovpnclient.sh processes imported .ovpn files without adequately sanitizing user-controlled content, enabling embedded shell metacharacters or directives to execute at the OS level. A public proof-of-concept exploit is available on GitHub; an official vendor-released patch exists in beta firmware, and no public exploit identified at time of analysis has been confirmed by CISA KEV as actively exploited in the wild.
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates.
Ax1800 Firmware versions up to 4.2.0 is affected by improper restriction of excessive authentication attempts (CVSS 6.5).
Ax1800 Firmware versions up to 4.2.0 is affected by improper restriction of excessive authentication attempts (CVSS 5.1).
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. [CVSS 8.1 HIGH]
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A denial-of-service issue was discovered on certain GL-iNet devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before version 4.5.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices through 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on GL.iNet devices through 4.5.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices running firmware before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 17.7%.
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the `remove_rule` RPC endpoint. The vulnerable parameter `args.id` in `/usr/share/gl-ngx/oui-rpc.lua` is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation.
Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface.
Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis.
Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment.
Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device.
Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk.
Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis.
Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface.
Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required.
Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation.
Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed.
Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk.
Command injection in the GL.iNet GL-MT3000 travel router's Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) allows authenticated remote attackers to execute arbitrary OS commands on devices running firmware up to 4.4.5. Publicly available exploit code exists on GitHub, and the issue is fixed in firmware 4.7 (with 4.8.1 currently published by the vendor). No CISA KEV listing has been confirmed, but the combination of a published PoC and an internet-exposable management interface raises the practical risk above the headline CVSS score.
Authenticated command injection in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5) lets remote attackers with low-privileged access execute arbitrary OS commands via the replace_country function in the Tor Proxy Service configuration handler. Publicly available exploit code exists for the flaw, and the vendor has shipped a fix; no public exploit identified at time of analysis as actively exploited in the wild.
Remote authentication bypass in GL.iNet GL-RM1, GL-RM10, GL-RM10RC, and GL-RM1PE versions up to 1.8.1 allows authenticated remote attackers with high privileges to manipulate the Factory Reset Handler component, resulting in improper authentication controls. The vulnerability requires high attack complexity and is difficult to exploit but enables unauthorized access to sensitive device functionality. A vendor-released patch addressing this issue is available in version 1.8.2.
Unrestricted authentication brute-forcing in GL-iNet Comet (GL-RM1) KVM web interface allows remote unauthenticated attackers to compromise device credentials and potentially pivot to connected systems. The web interface lacks rate limiting or account lockout mechanisms on login attempts, enabling dictionary and credential stuffing attacks against the network-accessible management console. EPSS score of 0.03% indicates low observed exploitation probability, though the 9.3 CVSS v4.0 reflects severe potential impact with cross-scope confidentiality and integrity compromise to subsequent systems. Vendor patch version 1.7.2 addresses the vulnerability per CISA advisory VA-26-076-01.
Physical UART access on GL-iNet Comet (GL-RM1) KVM grants unauthenticated attackers complete device control with high confidentiality, integrity, and availability impact. This hardware-level authentication bypass (CWE-306) requires disassembling the device and connecting to internal serial pins, significantly limiting practical exploitation despite the 7.0 CVSS score. EPSS probability is very low (0.03%, 7th percentile), consistent with the physical access requirement. No active exploitation confirmed; CISA CG reported this vulnerability alongside vendor firmware version 1.8.2 reference, suggesting patch availability.
Firmware update integrity checks in GL-iNet Comet (GL-RM1) KVM can be bypassed by attackers positioned on the network path or who have compromised the update server. The device relies solely on MD5 hash verification, which an attacker can recalculate after modifying the firmware image. Successful exploitation allows installation of malicious firmware, granting persistent control over the KVM device and potentially compromising all systems managed through it. EPSS score is minimal (0.01%), indicating low likelihood of mass exploitation, but CVSS 7.0 and specialized targeting of KVM infrastructure suggest high impact for targeted attacks. No public exploit code identified at time of analysis.
GL-iNet GL-AR300M16 v4.3.11 has a command injection in the set_config function, adding to the growing list of injection vulnerabilities in this device. This is the fourth distinct command injection CVE for this router model.
GL-iNet GL-AR300M16 v4.3.11 contains another command injection vulnerability, this time via the module parameter in the M.get_system_log function. Part of a series of command injection flaws in this router model.
SQL injection in GL-iNet GL-AR300M16 firmware v4.3.11 allows authenticated attackers to execute arbitrary database commands through the add_group() function via crafted HTTP requests. The vulnerability affects all installations of the affected firmware version and requires valid credentials to exploit. No patch is currently available to remediate this high-severity flaw.
GL-iNet GL-AR300M16 v4.3.11 has multiple command injection vulnerabilities in the set_upgrade function through seven different parameters. Each parameter provides an independent code execution vector on the router.
GL-iNet GL-AR300M16 router (v4.3.11) is vulnerable to command injection through the string port parameter in the enable_echo_server function. Unauthenticated attackers can execute arbitrary commands on the router.
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 52.3%.
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism.
OS command injection in GL.iNet BE9300 and MT6000 router firmware 4.8.x allows remote low-privileged attackers to execute arbitrary operating system commands via unsanitized dest_port and dest_ip arguments in the Firewall-management RPC component. The vendor has confirmed the vulnerability through their CVE issues GitHub repository and released a fix in firmware version 4.9.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute arbitrary shell commands via the Wi-Fi Timer Power-Schedule feature by manipulating the switch_power or restore_power arguments. The vendor has independently confirmed the vulnerability exists. A public write-up exists in the vendor's own CVE issues repository describing the attack as a cron-based RCE path, and no public exploit with KEV listing has been identified at time of analysis. The CVSS 4.0 score of 5.3 (with PR:L) reflects that low-privilege authentication is required, but the real-world impact of arbitrary command execution on a network router warrants elevated attention beyond what the score conveys.
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Improper authorization in GL.iNet's eSIM LPA API allows adjacent-network unauthenticated attackers to bypass nginx proxy controls on six cellular router models, gaining unauthorized access to eSIM management functions. Affected devices include the E5800, E750, X2000, X3000, XE3000, and XE300 running firmware up to 20260707. The GitHub advisory title explicitly frames this as 'Unauthenticated access to eSIM LPA API via nginx proxy bypass,' indicating the authorization enforcement failure lies in how nginx proxies requests to the /sdk/v1 endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models running firmware 4.8.x enables a low-privileged remote attacker to exploit a static authentication token and potentially execute unauthorized commands against the NAS subsystem. The vulnerability is rooted in CWE-321 (Use of Hard-coded Cryptographic Key), where the firmware embeds a fixed authentication secret that cannot be rotated by users or administrators. No public exploit identified at time of analysis, and the vendor has released firmware 4.9.0 as a fix.
Command injection in GL.iNet GL-MT3000 routers running firmware up to 4.4.5 allows remote attackers to inject shell commands through the Password argument of the SET_USER_PWD handler in /cgi-bin/glc (function FUN_0042e200). The flaw is network-reachable with low complexity, but no public exploit is identified at time of analysis and the vendor disputes practical exploitability, stating that single-quote escaping in the shell context blocks the reported $() and backtick payloads.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to inject shell commands via the media_dir parameter handled by the snprintf call in /cgi-bin/glc's FTP protocol handler. The CVSS vector indicates network-reachable, unauthenticated exploitation with low complexity, and publicly available exploit code exists on GitHub (StrTzz123/iot_vul). The vendor has issued firmware 4.8.1 and disputes reproducibility on the patched build, stating that escape_single_quote() now sanitizes the input before it reaches the FTP configuration write path.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to execute arbitrary OS commands by manipulating the dev_name argument passed to the dlopen function in the /usr/lib/oui-httpd/rpc/ Path Normalization Handler, reachable via the nas-web.eject_disk RPC method. Publicly available exploit code exists on GitHub demonstrating the chain. No CISA KEV listing and EPSS data was not provided, but the network-reachable, no-authentication CVSS vector combined with public PoC makes this a meaningful risk for exposed devices.
Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows a remote, low-privileged attacker to execute arbitrary OS commands via the `rpc_sys` function exposed through the LuCI JSON-RPC interface at `/cgi-bin/luci/rpc`. The vendor has confirmed the vulnerability and released a fix in firmware 4.8.1; critically, versions after 4.7.13 no longer install LuCI by default, eliminating the attack surface for most current deployments. Publicly available exploit code exists in a GitHub repository, though no active exploitation has been confirmed by CISA KEV.
Remote command injection in GL.iNet GL-MT3000 firmware versions up to 4.4.5 enables a network-reachable, high-privilege attacker to execute arbitrary OS commands through the Minidlna service's /rpc endpoint by manipulating the kube.set argument of the realpath function. The vendor has confirmed the vulnerability and released a fix in firmware version 4.7, citing SDK-level global sanitization as the remediation. Publicly available exploit code exists in a GitHub proof-of-concept repository (StrTzz123/iot_vul), though no active exploitation has been confirmed by CISA KEV at time of analysis.
Command injection in GL.iNet GL-MT3000 router firmware (versions up to 4.4.5) allows a low-privileged remote attacker to execute arbitrary OS commands by manipulating the 'device' argument passed to the iwinfo_backend function in iwinfo.so. A public proof-of-concept exploit is available on GitHub, raising the realistic likelihood of opportunistic abuse. The vendor has confirmed the issue and released firmware 4.7 with a global injection interception protection in the SDK.
Command injection in GL.iNet MT3000 routers running firmware up to version 4.4.5 allows authenticated remote attackers to execute arbitrary OS commands by supplying a crafted OpenVPN configuration file through the device's OpenVPN Client Import Workflow. The shell script ovpnclient.sh processes imported .ovpn files without adequately sanitizing user-controlled content, enabling embedded shell metacharacters or directives to execute at the OS level. A public proof-of-concept exploit is available on GitHub; an official vendor-released patch exists in beta firmware, and no public exploit identified at time of analysis has been confirmed by CISA KEV as actively exploited in the wild.
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates.
Ax1800 Firmware versions up to 4.2.0 is affected by improper restriction of excessive authentication attempts (CVSS 6.5).
Ax1800 Firmware versions up to 4.2.0 is affected by improper restriction of excessive authentication attempts (CVSS 5.1).
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. [CVSS 8.1 HIGH]
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A denial-of-service issue was discovered on certain GL-iNet devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on certain GL-iNet devices. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before version 4.5.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices through 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on GL.iNet devices through 4.5.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on GL.iNet devices running firmware before 3.216. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 17.7%.
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.