The Logread Lua RPC plugin in GL.iNet GL-MT3000 routers contains a function called logread.get_system_log that accepts an argument named module. The code does not properly sanitize this argument, making it possible for an attacker to inject arbitrary shell commands. When executed through the exposed RPC endpoint, these commands run with the privileges of the router’s operating system, giving the attacker full control over the device. The CVE description confirms that the attack can be carried out remotely and that exploit code is publicly available.

Devices running GL.iNet GL-MT3000 firmware version 4.4.5 or earlier are affected. The vulnerability resides in the rpc/logread component located under /usr/lib/oui-httpd/rpc/logread. Firmware releases newer than 4.4.5 that include a patch to sanitize the module argument are not impacted.

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score is now 2%, indicating a non-negligible exploitation probability, which combined with a publicly available exploit and the remote attack surface suggests a meaningful threat. The vulnerability is not catalogued in CISA’s KEV database, but because the attacker can reach the vulnerable RPC endpoint from the internet, the risk of compromise is substantial.