CyberRota Analysis
AI-GeneratedThe GL.iNet GL-MT3000 devices running firmware versions up to 4.4.5 are vulnerable to command injection through the network.switch_info/network.switch_status function in the Network Lua RPC Plugin. This flaw allows remote attackers to execute arbitrary commands, posing a significant risk to the integrity and security of affected systems. Organizations using these devices should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.