A critical command injection vulnerability in GL.iNet routers allows unauthenticated attackers to execute arbitrary commands with root privileges.

The vulnerability involves an OS command injection flaw where the web management interface fails to sanitize input, allowing an unauthenticated attacker to bypass security checks. This can lead to full device compromise via remote command execution.

This vulnerability carries a severe risk as it allows for complete control over the network infrastructure device. With a CVSS score of 8.3, the potential for unauthorized access to the local network, traffic interception, or the use of the router as a pivot point for further attacks makes this a high-priority security concern.

Immediate Action: Update the firmware of all affected GL.iNet devices to version 4.9.0 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router management interface or unexpected administrative login attempts.

Compensating Controls: Disable remote administrative access to the web interface and isolate management traffic to a secure, internal network segment.

Public Exploit Available: Yes, a proof-of-concept is documented in the GL.iNet CVE-issues GitHub repository.

Given the availability of a proof-of-concept and the potential for full system compromise, immediate firmware updates are essential. Network administrators must treat this as a high-urgency task to prevent unauthorized network access and potential exploitation of the router devices.