The GL-iNet GL-AR300M16 firmware 4.3.11 contains a SQL injection vulnerability in the add_group() function that allows an attacker to execute arbitrary SQL database operations via a crafted HTTP request. This defect can lead to unauthorized read, modification, or deletion of database contents, thereby compromising confidentiality and integrity of the device’s configuration and stored data. The vulnerability is classified as CWE‑89 according to the vendor description.

Affected product: GL‑iNet GL‑AR300M16 router with firmware version 4.3.11. The vulnerability exists in the device firmware component identified by the CPE cpe:2.3:o:gl‑inet:ar300m16_firmware:4.3.11. No other version variants are listed.

The CVSS score of 8.8 indicates a high severity of the flaw. EPSS indicates an exploitation probability of less than 1 %. It is not listed in the CISA KEV catalog. The CVE description does not specify an exact attack vector, but the flaw is triggered by a malicious HTTP request to the device, implying a remote, web‑based exploitation scenario that could be executed from an adjacent network or over the internet if the router is publicly reachable. Although the low EPSS suggests limited current exploitation, the high CVSS warrants timely remediation.