A command injection flaw exists in the Online Firmware Upgrade Handler's one_click_upgrade binary on GL.iNet GL‑MT3000 routers. The flaw allows a remote actor to inject arbitrary shell commands through malformed input to one_click_upgrade. The attacker can execute commands with the privileges of the binary, enabling full compromise of the router’s operating system. The weakness aligns with CWE‑74 and CWE‑77, typical of command injection vulnerabilities.

GL.iNet routers of the MT3000 model with firmware versions up to 4.4.5 are affected. The issue is fixed in firmware 4.7 and later. Devices running older firmware that still expose the Online Firmware Upgrade feature are at risk. No other GL.iNet products or newer firmware versions are impacted.

The CVSS score of 8.7 highlights a high severity. Although the EPSS score is unavailable, the vulnerability has already been publicly disclosed and the exploit code exists. The attack can be delivered remotely via the Online Firmware Upgrade interface, meaning an adversary only needs the ability to communicate with the device over its network. Because the flaw permits arbitrary command execution, the potential impact includes full device takeover, credential compromise, and denial of service. The vulnerability is not yet in the CISA KEV catalog, but the public availability of the exploit raises concern for immediate remediation.