This vulnerability allows an attacker to bypass authentication on certain GL.iNet routers by submitting a specially crafted username that is both a syntactically valid SQL statement and a regular expression. The resulting authentication bypass grants full administrative access, enabling the attacker to alter device configuration, install malware, or disrupt network services. The weakness is a direct exploitation of improper input validation and authorization checks, putting the confidentiality, integrity, and availability of the network infrastructure at risk.

Affected devices are GL.iNet routers running the 4.x firmware series, specifically models GL-MT3000, GL-AR300M, GL-B1300, GL-AX1800, GL-AR750S, GL-MT2500, GL-AXT1800, GL-X3000, and GL-SFT1200. The vulnerability has been confirmed for firmware version 4.3.7; other 4.x releases are likely affected but not explicitly confirmed in the available data.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of <1% indicates a low likelihood of exploitation in the near term. Nonetheless, the remote authentication bypass allows an attacker to gain full administrative control, which is a high‑impact capability. The attack vector is inferred to be local or remote management interfaces, where an attacker sends a specially crafted username to the login endpoint. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is reported yet, but the potential for targeted attacks remains significant.