The GL.iNet GL-MT3000 device running firmware 4.4.5 contains a command injection vulnerability in the FTP Protocol Handler's snprintf function in /cgi-bin/glc. Specifically, manipulation of the media_dir argument can lead to remote command injection due to insufficient input sanitization. The vendor addressed this in firmware version 4.8.1 by escaping single quotes in media_dir input, which prevents attackers from closing quotes and injecting shell commands. Verification on 4.8.1 showed that although the API returns success, injected payloads do not execute commands, indicating effective mitigation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and confidentiality. This could lead to unauthorized control or disruption of the device's FTP service. However, the vulnerability is fixed in version 4.8.1, which prevents command execution despite accepting input. There are no known exploits in the wild as of the publication date.

Upgrade affected GL.iNet GL-MT3000 devices from firmware version 4.4.5 to version 4.8.1 or later. The vendor's fix escapes single quotes in the media_dir argument, effectively preventing command injection. No additional mitigations are required if the device is running the updated firmware. Patch status is confirmed by vendor advisory statements embedded in the description.