An OS command injection vulnerability in multiple GL.iNet router models allows authenticated attackers to execute arbitrary code via scheduling features.

This vulnerability is an OS command injection flaw (CWE-78) occurring within the cron job handling logic for power and Wi-Fi scheduling. An attacker with low-level authenticated access can manipulate these parameters to execute system-level commands.

Successful exploitation grants an attacker the ability to execute commands with the privileges of the system, potentially resulting in complete device takeover. Because these devices serve as critical network gateways, such a compromise could facilitate man-in-the-middle attacks or internal network reconnaissance. The CVSS score of 7.4 underscores the high risk of this vulnerability to organizational network integrity.

Immediate Action: Check the vendor website for the latest firmware updates and apply them as soon as they become available for the specific router model.

Proactive Monitoring: Monitor system logs for unexpected execution of cron tasks or modifications to scheduled power settings.

Compensating Controls: Limit access to the device web interface to authorized personnel and ensure that administrative credentials are complex and unique.

Public Exploit Available: Unknown.

Given the breadth of affected hardware, administrators must perform an inventory of all GL.iNet devices and prepare for firmware deployment. Until patches are applied, restrict management interface access to minimize the window of opportunity for an attacker to authenticate.