Executive brief
A security vulnerability exists in the GL.iNet GL-MT3000 router firmware that could allow an authenticated user to take full control of the device. By sending specially crafted requests to the router's management interface, an attacker can execute system-level commands. This could lead to complete device compromise, interception of network traffic, or disruption of internet services.
Technical details
A command injection vulnerability exists in the LuCI JSON-RPC interface of GL.iNet GL-MT3000 firmware version 4.4.5. The vulnerability is located in the rpc_sys function within /cgi-bin/luci/rpc. The root cause is a failure to implement a method whitelist when cloning the luci.sys module; the jsonrpc.handle function uses reflective table lookup (rawget) to dispatch requested methods. Because luci.sys.exec is aliased to luci.util.exec (which utilizes io.popen), an authenticated attacker with root-level credentials can execute arbitrary shell commands as root and receive the output in the JSON-RPC response. The vendor has mitigated this in newer versions (4.7.13+) by removing LuCI by default and has released a fix in version 4.8.1.
Affected products
- GL.iNet GL-MT3000 Firmware 4.4.5
Timeline
- 2026-05-11: disclosed: Vulnerability submitted by researcher
- 2026-06-07: advisory: NVD publication date
- 2026-08-19: patched: Firmware version 4.8.1 released