The vulnerability exists in the set_upgrade function of GL‑iNet GL-AR300M16 firmware version 4.3.11, where several input parameters (modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, upgrade_type) are not properly validated, enabling a malicious actor to inject and execute arbitrary OS commands. This results in potential compromise of device confidentiality, integrity, and availability, as an attacker could fully control the device through arbitrary command execution (CWE-77).

GL‑iNet GL-AR300M16 routers running firmware v4.3.11, as identified by the provided CPE strings for the model and firmware. No other vendors or product lineages are listed in the CVE entry.

The CVSS score of 9.8 indicates high severity, and the EPSS score of 3% shows a moderate probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no known active exploits. Attack likely remote via network access to the upgrade interface; no explicit details are provided. The risk remains high because an attacker could take full control of the device via injected commands.