A command injection vulnerability was identified in GL-iNet GL-MT3000 routers running firmware up to version 4.4.5. The vulnerability exists in the function server.set_peer within the /cgi-bin/glc file of the wg-server.so Native Plugin component. An attacker can manipulate the public_key argument to inject arbitrary commands. Remote exploitation is possible without requiring physical access to the device. A public exploit is already available, increasing the risk of active exploitation. The vendor was notified early and confirmed the vulnerability exists. This affects IoT/networking hardware used in home and small business environments. The vulnerability poses significant risk due to the combination of remote exploitability and publicly available exploit code.