The flaw resides in the dlopen function of the Path Normalization Handler within the /usr/lib/oui-httpd/rpc component of GL.iNet GL‑MT3000 firmware 4.4.5. By manipulating the dev_name argument, an attacker can cause the handler to evaluate a malicious path and execute arbitrary shell commands. This satisfies both path traversal (CWE‑74) and command injection (CWE‑77) weaknesses, allowing the attacker to gain remote code execution privileges on the device.

Affected systems are GL.iNet GL‑MT3000 routers running firmware version 4.4.5 (the only publicly disclosed vulnerable build). The issue is fixed in firmware 4.7, which adds method‑level validation to the HTTP /rpc API and removes the eject_disk method from the allowed list, preventing the exploitation chain described by the report.

The CVSS score of 6.9 indicates a moderate severity, and the vulnerability can be exploited over the network via the exposed /rpc endpoint. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so the public exploitation risk appears moderate but cannot be ruled out. An attacker who can reach the device's RPC interface—potentially through LAN or VPN—can craft a custom dev_name value and trigger command execution remotely.