A command injection vulnerability has been identified in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw exists in the nas-web.add_user function within the /cgi-bin/glc file of the nas-web RPC Wrapper component. An attacker can remotely exploit this vulnerability by manipulating input to achieve command injection. A public exploit is already available, increasing the risk of active exploitation. The vendor was notified early in the disclosure process and confirmed the vulnerability's existence. This affects IoT/router hardware widely used in home and small office environments. The public availability of exploit code significantly elevates the risk level for unpatched devices.