GL-iNet GL-AR300M16 firmware v4.3.11 contains a command injection flaw in the M.get_system_log function. The module parameter supplied to this function is not validated, allowing an attacker to inject arbitrary shell commands into the system. The attacker, if able to trigger this path, could gain unrestricted command execution, compromising confidentiality, integrity, and availability of the device and potentially the entire network it serves.

Affected product: GL-iNet GL-AR300M16 with firmware version 4.3.11. The vulnerability is identified for the cpe:2.3:h:gl-inet:ar300m16:-:*:*:*:*:*:*:* and cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*.

The CVSS score is 9.8 indicating a critical level of risk. The EPSS score is reported to be less than 1%, suggesting that the overall probability of exploitation observed in the wild is low, yet the existence of the flaw with such high impact mandates action. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, via network communication to the router’s management interface where the get_system_log function is exposed, but the exact method of exploitation (e.g., HTTP request, SNMP, etc.) is not explicitly detailed in the provided description.