Command Injection in GL.iNet GL-MT3000 via Logread Lua RPC

Executive Summary

This vulnerability is a command injection flaw in the GL.iNet GL-MT3000 router up to version 4.4.5. It exists in the Logread Lua RPC plugin, specifically in the function logread.get_system_log. The issue allows an attacker to inject malicious commands via the module argument, which can be executed remotely.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for command injection attempts targeting the GL.iNet GL-MT3000 device. Monitor logs for unusual commands or module parameter values in the logread.get_system_log function. Inspect network traffic for suspicious RPC requests to /usr/lib/oui-httpd/rpc/logread.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the affected device, potentially gaining control over it. This could lead to unauthorized access, data theft, or disruption of network services. The public availability of the exploit increases the risk of real-world attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GL.iNet GL-MT3000 to the latest firmware version beyond 4.4.5. Disable remote access to the Logread Lua RPC plugin if not required. Implement network segmentation to limit exposure. Monitor for exploitation attempts and block suspicious IPs.

Useful 0 Not Useful 0