A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Nat…

A command injection vulnerability has been identified in GL-iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the s2s.enable_echo_server function within the /cgi-bin/glc file of the s2s.so Native Plugin component. An attacker can exploit this vulnerability by manipulating the 'port' argument to inject arbitrary commands. The attack can be initiated remotely without physical access to the device. A public exploit has been released, increasing the risk of active exploitation. The vendor was notified early in the disclosure process and confirmed the vulnerability's existence. This represents a significant risk to IoT network infrastructure devices deployed in home and small business environments.