A command injection vulnerability has been identified in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the Network Lua RPC Plugin, specifically within the network.switch_info and network.switch_status functions located at /usr/lib/oui-httpd/rpc/network. An attacker can manipulate the 'switch' argument to inject arbitrary commands. The vulnerability is remotely exploitable without physical access to the device. A public exploit has been disclosed, increasing the risk of active exploitation. The vendor was notified early in the disclosure process and confirmed the vulnerability's existence. IoT devices like routers are high-value targets due to their network-central position and often limited patch management.