Summary
A command injection vulnerability in the Logread Lua RPC plugin of GL.iNet GL-MT3000 routers allows arbitrary system commands to be executed via the record_size argument to logread.set_config.
When an attacker can reach the vulnerable RPC interface and supply crafted input, they may gain high-impact control over the device's operating system.
Affected context
This vulnerability occurs in GL.iNet GL-MT3000 devices running firmware up to 4.4.5 within the Logread Lua RPC Plugin.
It is exposed when the logread.set_config RPC method is reachable over the device's management or API interface and accepts user-controlled record_size values.
The issue is most relevant in deployments where the router's administrative interfaces are accessible from untrusted networks or where local clients can issue RPC calls to the logread service.
Exploit preconditions
- Attack surface: The Logread Lua RPC interface on GL.iNet GL-MT3000 (e.g., management/API endpoint).
- Required access: Ability to call
logread.set_configand control therecord_sizeparameter (via HTTP/RPC or similar mechanism). - Trigger point: Invocation of the logread configuration update that passes
record_sizeinto an underlying shell or command-building routine. - Why exploitation is possible: The input is incorporated into shell command context without sufficient sanitization or quoting, enabling injection of additional command fragments.
Why this happens
The underlying bug class aligns with CWE-77: Command Injection and CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
The Logread Lua RPC plugin's logread.set_config function treats the record_size argument as trusted data and feeds it into command execution or shell-style constructs without robust neutralization of metacharacters.
This insecure pattern allows attacker-controlled input to escape intended parameter boundaries and be interpreted as executable shell syntax by the downstream command processor.
Potential impact
- Full execution of arbitrary system commands on the router operating system
- Modification of device configuration, firewall rules, and network routing behavior
- Installation of persistent malware or backdoors on the device
- Interception, redirection, or logging of network traffic passing through the router
- Use of the compromised router as a pivot point for attacks against internal networks
General mitigation guidance
Effective mitigation centers on preventing user-controlled data from entering command execution contexts and reducing trust in management inputs.
Common defensive patterns include:
- Avoiding shell-based command construction; prefer direct API calls or library functions that do not interpret shell syntax.
- Strictly validating and constraining parameters such as sizes, identifiers, and flags to well-defined ranges and types before use.
- Applying consistent encoding or escaping for any data that must be passed to a command interpreter, ensuring special characters are neutralized.
- Running management and RPC services with least-privilege accounts and minimizing their access to sensitive system utilities or configuration files.
- Restricting exposure of administrative and RPC interfaces, using network segmentation and strong authentication to reduce untrusted input sources.
How teams detect issues like this
Organizations can detect similar command injection risks by:
- Applying static analysis rules that flag concatenation of user-controlled data into shell commands, system calls, or
os.execute-style APIs. - Reviewing RPC handlers and management endpoints for parameters that are passed directly into command line strings or interpreter contexts.
- Enforcing secure coding policies that prohibit shell-based command construction and require parameterized or API-based operations instead.
- Leveraging automated security testing tools (SAST/DAST) configured to search for injection patterns in Lua, C, and related router firmware codebases.
- Incorporating targeted penetration tests against management interfaces to exercise edge-case inputs and identify unsafe command usage paths.
