Unauthenticated RCE in GL-MT3000 via /cgi-bin/glc endpoint

Vulnerability Overview An unauthenticated command injection vulnerability exists in the method. This vulnerability is located at the endpoint and is triggered via the native plugin. For each server entry, the field is extracted, and a or suffix is appended before being passed to the function. This function constructs a shell command, embedding the attacker-controlled hostname into an template, and executes it via . Since no shell escaping or meta-character filtering is applied to the hostname, command substitution via can be triggered at any position, leading to unauthenticated root command execution. Affected Scope Affected Product: GL-MT3000 Affected Version: 4.4.5 Firmware Version: openwrt-mt3000-4.4.5-0811-1691754744.tar.gz Vulnerable Endpoint: Vulnerable Method: Remediation 1. Input Validation: Perform strict input validation on the field to ensure it does not contain any special characters or command injection symbols. 2. Command Escaping: Properly escape the before executing shell commands to prevent command injection. 3. Principle of Least Privilege: Reduce the user privileges under which commands are executed to avoid running them with root permissions. 4. Code Review: Conduct code reviews on similar functions to ensure there are no other similar command injection vulnerabilities. POC Code Exploit Code Exploit Example Exploit Screenshot !Exploit Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result Exploit Code Execution Screenshot !Exploit Code Execution Screenshot Exploit Code Execution Result ```bash curl -sk ... -o {} cat /tmp/p1

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated RCE in GL-MT3000 via /cgi-bin/glc endpoint

More from this source