This vulnerability affects GL.iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5. The issue is a command injection in the iwinfo_backend function within the iwinfo.so file of the MTK Backend component. By manipulating the device argument, an attacker can execute arbitrary commands remotely. The vendor has addressed this by adding global protection against malicious injection starting from firmware version 4.7. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector and no user interaction required.

Successful exploitation allows remote attackers to execute arbitrary commands on affected devices, potentially compromising device integrity and confidentiality. The vulnerability is exploitable remotely without user interaction, increasing risk. However, the CVSS score and vendor advisory suggest a medium severity impact.

The vendor recommends upgrading affected devices to firmware version 4.7 or later, which includes global protection to intercept malicious command injections. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in the advisory, but upgrading to version 4.7 is the recommended action.