Remote command injection in the GL-iNet GL-MT3000 WireGuard server component exposes the device to unauthorized remote code execution.

The flaw exists in the server.set_peer function within the /cgi-bin/glc file. By manipulating the public_key argument, an unauthenticated remote attacker can trigger command injection.

The CVSS score of 9.8 reflects the severity of this remote code execution vulnerability. Successful exploitation permits full device takeover, which could lead to network-wide compromise, data interception, and total loss of device integrity.

Immediate Action: Update the GL-iNet GL-MT3000 device to the latest firmware version. Consult the vendor security advisory for the specific release that addresses this vulnerability.

Proactive Monitoring: Monitor for anomalous traffic or unexpected execution of system commands, particularly those related to WireGuard peer management.

Compensating Controls: Use firewall rules to isolate management interfaces and WireGuard configuration endpoints from the public internet.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability presents a severe risk to network infrastructure. IT administrators must prioritize updating all affected GL-MT3000 units to the latest firmware version to eliminate the risk of remote code execution.