The GL.iNet GL-MT3000 router firmware versions 4.4.0 to 4.4.5 contain a command injection vulnerability in the set_upgrade function of the /cgi-bin/glc endpoint within the modem.so component. This vulnerability permits unauthenticated remote attackers to execute arbitrary commands on the device by manipulating input to this function. The vulnerability has been publicly disclosed and confirmed by the vendor. No official fix or patch has been announced as of the publication date.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on affected GL-MT3000 devices without any authentication or user interaction. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of service. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict network access to the device's management interface to trusted networks only and monitor for any suspicious activity. Avoid exposing the device management interface to untrusted networks or the internet.