A flaw in the ovpnclient.sh script of GL.iNet MT3000 allows attackers to inject and execute arbitrary shell commands when a malicious OpenVPN configuration file is imported. The vulnerability stems from improper sanitization of user‑supplied data, falling under CWE‑74 and CWE‑77. An attacker who can trigger the import process—such as by uploading a crafted .ovpn file to the device—can potentially take full control, jeopardizing confidentiality, integrity, and availability of the system.

The flaw affects all GL.iNet MT3000 firmware releases up to and including 4.4.5. The vendor’s mitigation is available in firmware build 4.9.0_beta3-1012-0513-1778656146, which introduces checks to prevent injection via OpenVPN configuration files.

With a CVSS score of 5.3, the vulnerability is classified as moderate severity. Although EPSS data is not reported and the issue is not listed in CISA’s KEV catalog, public disclosure of an exploit demonstrates that the flaw is remotely exploitable. Attackers can supply a malicious configuration file from outside the local network, causing the device to execute arbitrary commands. The risk remains significant enough to warrant immediate remediation, especially for devices exposed to the internet or in untrusted environments.