This vulnerability affects the GL.iNet GL-MT3000 router models running firmware versions 4.4.0 to 4.4.5. The issue lies in the nas-web RPC Wrapper component, specifically the nas-web.add_user function in the /cgi-bin/glc file. By manipulating this function remotely, an attacker can perform command injection, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity, with no privileges or user interaction required for exploitation. Public exploit code is available, and the vendor has acknowledged the issue but has not published a fix or mitigation.

Successful exploitation allows remote attackers to execute arbitrary commands on affected GL.iNet GL-MT3000 devices without authentication or user interaction. This can lead to full compromise of the device, potentially impacting network security and device integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting remote access to the affected function or device, and monitor for exploit attempts. Follow updates from GL.iNet for any forthcoming patches or official mitigations.