| शीर्षक | GL.iNet GL-MT3000 4.4.5 Command Injection |
|---|
| विवरण | An authenticated command injection vulnerability exists in the logread.get_system_log RPC method of the affected product. The logread Lua RPC plugin at /usr/lib/oui-httpd/rpc/logread concatenates the user-supplied module parameter directly into a shell command string executed via io.popen(). The command's stdout is captured and returned in the RPC response, providing the attacker with immediate command output. No validation or sanitization is performed on the module parameter, resulting in root command execution. |
|---|
| स्रोत | ⚠️ https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/logread_get_system_log_rpc_rce/CVE.md |
|---|
| उपयोगकर्ता | strforexc (UID 94617) |
|---|
| सबमिशन | 08/06/2026 02:37 PM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 08:55 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385513 [GL.iNet GL-MT3000 तक 4.4.5 Logread Lua RPC plugin logread logread.get_system_log module अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|