A weakness in the Wi‑Fi Timer Power‑Schedule feature of many GL.iNet routers allows an attacker to inject operating‑system commands by manipulating the switch_power/restore_power argument. This results in remote code execution on the affected devices. The flaw is a classic command‑injection (CWE‑78) and also involves improper handling of user‑supplied input (CWE‑77).

Affected devices include GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000 routers running firmware up to version 4.8.x.

The CVSS score of 5.3 indicates moderate severity, yet the vulnerability can be leveraged remotely over the device’s management interface. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, which suggests limited current exploitation data but does not preclude future attacks. Attackers would need network access to the router and could remotely execute arbitrary commands if they can reach the switch_power/restore_power endpoint through the web interface or API.