The vulnerability resides in the replace_country function of the Tor Proxy Service Configuration Handler. It permits an attacker to inject arbitrary operating‑system commands through careful manipulation of the rpc/tor interface. Activation of the command injection would give the attacker the ability to run any command with the privileges of the underlying web server process. This leads to remote code execution on the device and thus full compromise. The weakness reflects CWE‑74 and CWE‑77.

The flaw affects GL.iNet GL‑MT3000 devices running firmware versions up to and including 4.4.5. All firmware releases before 4.7 contain the vulnerable replace_country implementation. GL.iNet has released firmware 4.7 which removes the flaw. The vulnerability is present in the tor configuration component only; no other products or components are listed.

The CVSS score of 8.7 flags the issue as high severity, and public exploits are already available, meaning real‑world attacks are plausible. The exploit can be launched from a remote system that can reach the RPC endpoint, presumably over the device’s LAN or WAN interface; no authentication prerequisites are mentioned, so the attacker may be able to use the service from any reachable location. The EPSS score is not published, and the flaw is not yet in the CISA KEV catalogue, but the presence of a public exploit and remote access capabilities makes it a high‑risk vulnerability that requires immediate unmitigated action.