A command injection vulnerability has been identified in GL-iNet GL-MT3000 routers running firmware up to version 4.4.5. The vulnerability exists in the wg-server.generate_publickey function within the /cgi-bin/glc file of the wg-server.so Native Plugin component. An attacker can exploit this by manipulating the private_key argument to inject and execute arbitrary commands. The attack can be launched remotely without physical access to the device. A public exploit has already been disclosed and is available for use. The vendor was notified early and confirmed the existence of the vulnerability. This poses a significant risk to IoT/networking devices using the affected firmware.