This vulnerability involves a command injection flaw in the remove_rule function of the /usr/share/gl-ngx/oui-rpc.lua file in GL.iNet AX1800 devices running firmware versions up to 4.8.3. Remote attackers can exploit improper handling of the args.id argument to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and has a high CVSS 4.0 base score of 8.7. Although exploit code is publicly available, there is no confirmation of active exploitation in the wild. The vendor was contacted early about the issue, but no official fix or patch has been documented in the provided data.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on affected GL.iNet AX1800 devices, potentially leading to full system compromise. This could result in unauthorized control over the device, disruption of network services, or further attacks within the network environment. The high CVSS score reflects the critical nature of remote command injection with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been documented, users should monitor GL.iNet communications for updates. Until a patch is available, restricting remote access to the device's management interfaces and applying network-level controls to limit exposure may reduce risk.