The flaw exists in the Firewall‑management RPC component of GL.iNet BE9300 and MT6000 routers running firmware 4.8.x. An attacker can supply a crafted dest_port or dest_ip argument that bypasses normal validation and causes the operating system to execute arbitrary shell commands. This permits full control of the device, including data exfiltration, configuration changes, and lateral movement within the network. The weakness corresponds to command injection (CWE‑78) and path traversal (CWE‑77).

GL.iNet BE9300 and GL.iNet MT6000 routers with firmware version 4.8.x are affected. The vulnerability is resolved in firmware 4.9.0. No other model versions are listed as affected, and no confirmation exists for them.

The CVSS base score of 5.3 indicates moderate severity, and the attack vector is remote, as the RPC interface is reachable over the network. EPSS information is unavailable, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no documented widespread exploitation. Nevertheless, because the flaw enables arbitrary command execution, it should be treated as critical.