The vulnerability exists in the set_upgrade function of GL-iNet GL-AR300M16 firmware version 4.3.11, where several input parameters (modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, upgrade_type) are not properly validated, enabling a malicious actor to inject and execute arbitrary OS commands. This results in potential compromise of device confidentiality, integrity, and availability, as an attacker could fully control the device through arbitrary command execution (CWE-77).

Affected systems are GL-iNet GL-AR300M16 routers running firmware v4.3.11, as identified by the provided CPE strings for the model and firmware. No other vendors or product lineages are listed in the CVE entry.

The CVSS score of 9.8 reflects a high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not in the CISA KEV catalog, suggesting no known active exploits. It is inferred that the attack vector is remote, requiring network access to the device’s firmware upgrade interface, but explicit details are not provided. The risk remains high due to potential full device takeover if an attacker can reach the vulnerable endpoint.