GL.iNet GL-MT3000 vulnerabilities

A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the nas-web.add_user function in the /cgi-bin/glc file of the nas-web RPC Wrapper component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is public and may be used.

A security vulnerability has been detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the set_upgrade function in the /cgi-bin/glc file of the modem.so component. Such manipulation leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

GL.iNet GL-MT3000 router up to version 4.4.5 contains a command injection vulnerability in the remove_profile function in /cgi-bin/glc of the modem.so component. The attack can be performed remotely, and the exploit is publicly available.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the server.set_peer function of /cgi-bin/glc in the wg-server.so component. Manipulating the public_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the wg-server.generate_publickey function of /cgi-bin/glc in the wg-server.so component. Manipulating the private_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the s2s.enable_echo_server function of /cgi-bin/glc in the s2s.so component. Manipulating the port argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has an injection vulnerability in the plugins.set_config function of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote code execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the plugins.remove_package and plugins.install_package functions of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote command execution.

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used.

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the file /usr/bin/one_click_upgrade of the Online Firmware Upgrade Handler. The attack can be launched remotely. A public exploit is available.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the replace_country function of the Tor Proxy Service Configuration Handler. The attack can be initiated remotely. A public exploit is available.

A command injection vulnerability was found in GL.iNet GL-MT3000 up to version 4.4.5 in the function FUN_0042e200 of /cgi-bin/glc. The vendor claims it is fixed in version 4.8.1, but details are disputed.

In the GL.iNet GL-MT3000 device with firmware version 4.4.5, a command injection vulnerability was found in the snprintf function of the file /cgi-bin/glc in the FTP Protocol Handler component. Manipulating the media_dir argument can lead to command injection. The attack can be launched remotely. The vendor states that in version 4.8.1, single quotes are escaped, preventing the reported attack vectors.

A command injection vulnerability exists in the dlopen function of the /usr/lib/oui-httpd/rpc/ library in GL.iNet GL-MT3000 version 4.4.5 via the dev_name argument. The attack is remotely exploitable. The vendor confirms that version 4.7 introduces HTTP method-level validation, mitigating the issue.

In GL.iNet GL-MT3000 firmware version 4.4.5, a command injection vulnerability was found in the LuCI JSON-RPC interface via the rpc_sys function in /cgi-bin/luci/rpc. The attack is remotely exploitable. The vendor fixed it in version 4.8.1.

A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5 allowing OS command injection via the realpath function in /rpc (Minidlna Service). The attack can be launched remotely. The vendor confirms that version 4.7 includes global protection against such attacks.

In GL.iNet GL-MT3000 firmware up to version 4.4.5, a command injection vulnerability was found in the MTK Backend component via the device argument in iwinfo_backend in iwinfo.so. The attack is remotely exploitable. The exploit is public.