This vulnerability involves a command injection flaw in the GL.iNet GL-MT3000 firmware version 4.4.5, specifically in the dlopen function within the /usr/lib/oui-httpd/rpc/ library's Path Normalization Handler. By manipulating the dev_name argument, an attacker can remotely execute arbitrary commands on the device. The vendor fixed this by implementing method-level validation at the HTTP /rpc endpoint in version 4.7, removing the nas-web.eject_disk method from the whitelist, which prevents unauthorized calls and blocks the exploit chain.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device without authentication, potentially leading to full compromise of the device. This could impact device availability, confidentiality, and integrity. However, no known exploits in the wild have been reported to date.

Upgrade the GL.iNet GL-MT3000 device firmware to version 4.7 or later, where the vendor has implemented method-level validation and removed the vulnerable method from the allowed list, effectively blocking this command injection vulnerability. Patch status is confirmed by the vendor advisory embedded in the description.