Gl Mt3000

Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit.

Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface.

Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis.

Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment.

Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device.

Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk.

Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis.

Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface.

Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk.

Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required.

Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation.

Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed.

Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk.

Command injection in the GL.iNet GL-MT3000 travel router's Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) allows authenticated remote attackers to execute arbitrary OS commands on devices running firmware up to 4.4.5. Publicly available exploit code exists on GitHub, and the issue is fixed in firmware 4.7 (with 4.8.1 currently published by the vendor). No CISA KEV listing has been confirmed, but the combination of a published PoC and an internet-exposable management interface raises the practical risk above the headline CVSS score.

Authenticated command injection in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5) lets remote attackers with low-privileged access execute arbitrary OS commands via the replace_country function in the Tor Proxy Service configuration handler. Publicly available exploit code exists for the flaw, and the vendor has shipped a fix; no public exploit identified at time of analysis as actively exploited in the wild.

Command injection in GL.iNet GL-MT3000 routers running firmware up to 4.4.5 allows remote attackers to inject shell commands through the Password argument of the SET_USER_PWD handler in /cgi-bin/glc (function FUN_0042e200). The flaw is network-reachable with low complexity, but no public exploit is identified at time of analysis and the vendor disputes practical exploitability, stating that single-quote escaping in the shell context blocks the reported $() and backtick payloads.

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to inject shell commands via the media_dir parameter handled by the snprintf call in /cgi-bin/glc's FTP protocol handler. The CVSS vector indicates network-reachable, unauthenticated exploitation with low complexity, and publicly available exploit code exists on GitHub (StrTzz123/iot_vul). The vendor has issued firmware 4.8.1 and disputes reproducibility on the patched build, stating that escape_single_quote() now sanitizes the input before it reaches the FTP configuration write path.

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows remote attackers to execute arbitrary OS commands by manipulating the dev_name argument passed to the dlopen function in the /usr/lib/oui-httpd/rpc/ Path Normalization Handler, reachable via the nas-web.eject_disk RPC method. Publicly available exploit code exists on GitHub demonstrating the chain. No CISA KEV listing and EPSS data was not provided, but the network-reachable, no-authentication CVSS vector combined with public PoC makes this a meaningful risk for exposed devices.

Command injection in GL.iNet GL-MT3000 router firmware 4.4.5 allows a remote, low-privileged attacker to execute arbitrary OS commands via the `rpc_sys` function exposed through the LuCI JSON-RPC interface at `/cgi-bin/luci/rpc`. The vendor has confirmed the vulnerability and released a fix in firmware 4.8.1; critically, versions after 4.7.13 no longer install LuCI by default, eliminating the attack surface for most current deployments. Publicly available exploit code exists in a GitHub repository, though no active exploitation has been confirmed by CISA KEV.

Remote command injection in GL.iNet GL-MT3000 firmware versions up to 4.4.5 enables a network-reachable, high-privilege attacker to execute arbitrary OS commands through the Minidlna service's /rpc endpoint by manipulating the kube.set argument of the realpath function. The vendor has confirmed the vulnerability and released a fix in firmware version 4.7, citing SDK-level global sanitization as the remediation. Publicly available exploit code exists in a GitHub proof-of-concept repository (StrTzz123/iot_vul), though no active exploitation has been confirmed by CISA KEV at time of analysis.

Command injection in GL.iNet GL-MT3000 router firmware (versions up to 4.4.5) allows a low-privileged remote attacker to execute arbitrary OS commands by manipulating the 'device' argument passed to the iwinfo_backend function in iwinfo.so. A public proof-of-concept exploit is available on GitHub, raising the realistic likelihood of opportunistic abuse. The vendor has confirmed the issue and released firmware 4.7 with a global injection interception protection in the SDK.