This vulnerability affects the GL.iNet GL-MT3000 device firmware versions 4.4.0 through 4.4.5. It resides in the logread.set_config function within the /usr/lib/oui-httpd/rpc/logread component of the Logread Lua RPC Plugin. By manipulating the record_size argument, an attacker with local or adjacent network access can perform command injection, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. Although exploit code is publicly available, there is no evidence of widespread exploitation. The vendor has acknowledged the issue but has not yet released a fix or mitigation.

Successful exploitation of this vulnerability could allow an attacker with local or adjacent network access and low privileges to execute arbitrary commands on the affected device, potentially leading to full compromise of the device. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability. However, there is no current evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to the affected device's management interfaces to trusted networks and users only. Monitor vendor communications for updates on patches or official mitigations.