Technical impact
The Logread Lua RPC plugin in GL.iNet GL-MT3000 routers contains a function called logread.get_system_log that accepts an argument named module. The code does not properly sanitize this argument, making it possible for an attacker to inject arbitrary shell commands. When executed through the exposed RPC endpoint, these commands run with the privileges of the router’s operating system, giving the attacker full control over the device. The CVE description confirms that the attack can be carried out remotely and that exploit code is publicly available.
Affected Systems
Devices running GL.iNet GL-MT3000 firmware version 4.4.5 or earlier are affected. The vulnerability resides in the rpc/logread component located under /usr/lib/oui-httpd/rpc/logread. Firmware releases newer than 4.4.5 that include a patch to sanitize the module argument are not impacted.
Risk and Exploitability
With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score of 3% indicates a non‑negligible probability of exploitation, and because the exploit is publicly available the threat is real. The vulnerability is not catalogued in CISA’s KEV database, but because the attacker can reach the vulnerable RPC endpoint from the internet, the risk of compromise is substantial.
