This vulnerability involves command injection in the GL.iNet GL-MT3000 router's Logread Lua RPC plugin, specifically in the logread.get_system_log function. By manipulating the 'module' argument, an attacker can remotely execute arbitrary commands on the device. The affected versions are 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, and 4.4.5. The vendor has acknowledged the issue but no official fix or patch has been disclosed. The CVSS 4.0 score is 8.7, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected GL.iNet GL-MT3000 devices, potentially leading to full system compromise. This can result in unauthorized access, data manipulation, service disruption, or further network penetration. The high CVSS score reflects significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interfaces to trusted users only and monitor for suspicious activity related to the logread.get_system_log function. Avoid exposing the device to untrusted networks.