A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/lo…

A command injection vulnerability has been identified in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the logread.get_system_log function within the Logread Lua RPC plugin at /usr/lib/oui-httpd/rpc/logread. An attacker can manipulate the 'module' argument to inject arbitrary commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit is already available, increasing the risk of active exploitation. The vendor was notified prior to public disclosure and has confirmed the vulnerability's existence. This poses a significant risk to IoT/router deployments using the affected hardware and firmware.