A command injection vulnerability has been identified in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The vulnerability resides in the set_upgrade function within the /cgi-bin/glc file of the modem.so component. An attacker can exploit this flaw remotely without requiring physical access to the device. The exploit has been publicly disclosed and proof-of-concept code is available on GitHub, increasing the risk of active exploitation. The vendor was notified early and confirmed the vulnerability's existence. This affects IoT/networking hardware commonly used for travel and portable VPN routing. Successful exploitation could allow an attacker to execute arbitrary commands on the affected device. Users are advised to update firmware or apply mitigations as soon as a patch becomes available.