Threats tagged 'ghsa-35v2-77rf-53pc'

A command injection vulnerability exists in the Logread Lua RPC plugin of GL.iNet GL-MT3000 devices up to version 4.4.5. The issue arises from improper handling of the 'module' argument in the logread.get_system_log function, allowing remote attackers with limited privileges to execute arbitrary commands. The vulnerability has a high severity with a CVSS score of 8.8. The vendor has confirmed the vulnerability but no patch information is currently available. Exploit code is publicly available, increasing the risk of exploitation.