This vulnerability affects GL.iNet routers including models A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000 running firmware versions up to 4.8.x. It involves an OS command injection in the Wi-Fi Timer Power-Schedule feature triggered by manipulating the switch_power or restore_power arguments. The attack can be performed remotely without user interaction and requires low privileges. The vendor has acknowledged the issue but has not yet released a fix or mitigation instructions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary OS commands remotely on affected devices, potentially compromising device integrity and control. The impact is rated medium due to limited privileges required and low complexity, but the actual damage depends on the attacker's commands and environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit network exposure of affected devices and monitor for suspicious activity related to the Wi-Fi Timer Power-Schedule feature. No official mitigation or workaround has been provided by the vendor at this time.