Executive brief
A security vulnerability exists in the GL.iNet GL-MT3000 router that allows an unauthorized person to take control of the device over the network. By sending a specially crafted request to the router's web management interface, an attacker can execute arbitrary commands. This could lead to a complete compromise of the device, allowing attackers to intercept network traffic or disrupt internet services.
Technical details
An unauthenticated command injection vulnerability exists in the /cgi-bin/glc endpoint of GL.iNet GL-MT3000 firmware version 4.4.5. The glc CGI binary dynamically loads shared object plugins from /usr/lib/oui-httpd/rpc/ using dlopen() and executes exported functions via dlsym() without authentication or method whitelisting. Specifically, the nas-web.so plugin's eject_disk_do1 function fails to properly sanitize the dev_name parameter. An attacker can exploit a buffer size mismatch and Linux path normalization to bypass access() checks and inject shell commands into a system() call. The issue is mitigated in version 4.7 by implementing method-level validation and removing nas-web.eject_disk from the allowed RPC whitelist.
Affected products
- GL.iNet GL-MT3000 4.4.5
Timeline
- 2026-05-11: disclosed: Initial researcher submission
- 2026-06-07: advisory: NVD publication date