Threats tagged 'ghsa-767p-4fhm-3wpv'

GL.iNet GL-MT3000 devices up to version 4.4.5 contain a remote command injection vulnerability in the ovpn-client.get_recommend_config function within the ovpn-client.so plugin. This vulnerability arises from improper handling of the Hostname argument, allowing an attacker to execute arbitrary commands remotely without authentication. The vulnerability has a high severity with a CVSS score of 9.8 and has been publicly disclosed. The vendor has confirmed the issue but no patch information is currently available.