GL‑iNet GL‑AR300M16 firmware version 4.3.11 contains a command injection flaw in the enable_echo_server function. The vulnerability arises from unvalidated user input on the string port parameter, allowing an attacker to inject operating‑system escape sequences and construct arbitrary shell commands. The weakness is classified as CWE‑77. This flaw provides full control over the device’s operating system, enabling attackers to exfiltrate data, alter configuration, or pivot to other network assets.

The affected hardware is the GL‑iNet GL‑AR300M16 router running firmware 4.3.11. No other firmware revisions or product variants are currently documented as impacted. The vulnerability is confined to the enable_echo_server routine and does not affect other services on the device.

The CVSS score of 9.8 classifies this issue as Critical. The EPSS score is reported as less than 1 %, indicating a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires remote access to the device’s web or management interface, through which a crafted port value can be supplied to trigger the injection. This would allow an attacker with network reach to the router to run arbitrary commands, effectively compromising the host.