GL‑iNet GL‑AR300M16 firmware v4.3.11 contains a command injection flaw in the M.get_system_log function. The module parameter supplied to this function is not validated, allowing an attacker to inject arbitrary shell commands into the system. If this flaw is exploited, the attacker can execute arbitrary commands on the router, compromising device confidentiality, integrity, and availability and potentially affecting the entire network it serves.

The vulnerability is present in GL‑iNet GL‑AR300M16 routers running firmware version 4.3.11. The affected functionality is the get_system_log endpoint, which is exposed through the router’s management interface and accepts a maliciously crafted module parameter causing command injection.

The CVSS score is 9.8, indicating a critical level of risk. The EPSS score is 2%, indicating a slightly higher probability of exploitation observed in the wild, yet the existence of the flaw with such high impact mandates action. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, via network communication to the router’s management interface where the get_system_log function is exposed, but the exact method of exploitation (e.g., HTTP request, SNMP, etc.) is not explicitly detailed in the provided description.