A critical command injection vulnerability in GL.iNet GL-MT3000 routers allows unauthenticated remote code execution, posing a severe risk to device integrity.

This vulnerability is a command injection flaw (CWE-77) located in the ovpn-client.check_config function. It permits an unauthenticated remote attacker to execute system commands by manipulating the filename argument.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation grants attackers full control over the router, which can be leveraged to intercept network traffic, pivot into internal networks, or deploy persistent malware, leading to significant data breaches and operational downtime.

Immediate Action: Restrict management interface access to trusted networks only and monitor vendor channels for the release of a firmware patch addressing this specific component.

Proactive Monitoring: Review system logs for unusual process execution or modification attempts within the /cgi-bin/ directory.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the /cgi-bin/glc endpoint.

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub.

Given the critical severity and the public availability of exploit code, administrators must treat this vulnerability with the highest priority. If a patch is not yet available, implement strict network segmentation to isolate the affected devices from the internet until a secure update can be applied.