Threats tagged 'ghsa-qv2j-hh7r-m4m2'

A command injection vulnerability exists in the GL.iNet GL-MT3000 device up to version 4.4.5. The flaw is located in the ovpn-client.check_config function within the /cgi-bin/glc endpoint of the ovpn-client.so native plugin. An attacker can manipulate the filename argument to execute arbitrary commands remotely without authentication. The vulnerability has a high severity score of 9.8 and has been confirmed by the vendor. No patch or remediation information is currently available.