A command injection vulnerability has been discovered in GL-iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the plugins.remove_package and plugins.install_package functions within the /cgi-bin/glc file of the plugins.so Native Plugin component. An attacker can exploit this vulnerability remotely without physical access to the device. A proof-of-concept exploit has been publicly published, increasing the risk of active exploitation. The vendor was notified early in the disclosure process and has confirmed the vulnerability exists. This affects IoT/networking hardware widely used for travel and mobile networking. Users running affected firmware versions are advised to update immediately. The vulnerability has been tracked and referenced across multiple security databases including NVD and VulDB.