CVE-2023-29778

CriticalCVSS 9.8

Published: 02/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

15.88%

97th percentile - higher than 97% of all known CVEs

Summary

GL.iNET MT3000 version 4.1.0 Release 2 is vulnerable to OS command injection via the /usr/lib/oui-httpd/rpc/logread endpoint. An attacker can remotely execute arbitrary commands on the system.

Risk Assessment

The risk for the organization includes full device compromise, potentially leading to data theft, further network attacks, or the device being used as part of a botnet.

Recommendation

Immediately update the firmware to the latest version and restrict access to the management interface to trusted networks only.

Original NVD description (English source)

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.