Summary
A command injection vulnerability in GL.iNet GL-MT3000's Network Lua RPC plugin allows crafted switch parameters to be interpreted as shell commands.
When exposed over the network, an attacker can remotely execute system commands on the device by abusing the network.switch_info and network.switch_status RPC functions.
Affected context
This vulnerability arises in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5 that use the /usr/lib/oui-httpd/rpc/network Lua RPC plugin.
Specifically, the network.switch_info and network.switch_status functions process a switch argument that is passed in a way that can influence shell command execution.
The issue is most relevant when the RPC interface is reachable from untrusted networks, such as WAN or guest LAN segments, or when local attackers can issue crafted RPC calls through the web or API layer.
Exploit preconditions
- Attack surface: The HTTP/Lua RPC interface exposed by
oui-httpdand thenetworkRPC module on the GL-MT3000 router. - Required access: Ability to send crafted requests to the Network Lua RPC plugin (e.g., via the web interface or direct RPC endpoint), depending on how authentication and firewall rules are configured.
- Trigger point: Invocation of
network.switch_infoornetwork.switch_statuswith a maliciousswitchparameter that is later embedded into a shell command. - Why exploitation is possible: The
switchargument is not adequately validated, encoded, or constrained before being combined with shell commands, enabling injection of additional command syntax that the system interpreter executes.
Why this happens
The underlying bug class is command injection, where untrusted input is concatenated or interpolated into shell commands without proper neutralization.
In this case, the Lua RPC functions for network switch handling treat the switch parameter as a trusted value and pass it into shell-based utilities or scripts.
This behavior maps to CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') and is closely related to CWE-74: Improper Neutralization of Special Elements in Output, as user-controlled data influences command output without strict validation or whitelisting.
Abstractly, the insecure pattern is: using user-supplied identifiers directly in command strings or system calls instead of treating them as data and limiting them to safe, predefined values.
Potential impact
- Remote execution of arbitrary system commands on the router
- Complete compromise of the GL-MT3000 device's operating system environment
- Modification of network configuration, routing rules, and firewall policies
- Interception or redirection of user traffic traversing the router
- Deployment of persistent malware or backdoors on the device
- Lateral movement to other devices on the local network
General mitigation guidance
Effective mitigation focuses on treating all RPC parameters as untrusted input and avoiding direct command construction from user data.
Pattern-based defenses include:
- Replacing shell command construction with safe APIs or system calls that accept structured parameters rather than raw command strings.
- Constraining the
switchargument to a small, predefined set of allowed identifiers and rejecting all other values. - Applying rigorous input validation on RPC parameters, including character whitelisting and rejecting any command metacharacters.
- Avoiding shell interpretation entirely where possible by using native libraries or internal functions for network and switch management.
- Running web/RPC components with least privilege, limiting their ability to affect sensitive system state if compromised.
How teams detect issues like this
Organizations can detect similar command injection issues by:
- Applying static analysis rules that flag string concatenation or interpolation used in calls to
os.execute,io.popen,system, or equivalent shell-invoking APIs in Lua or C. - Reviewing RPC handler code for patterns where user-controlled parameters (such as
switch) flow directly into command strings or script invocations. - Enforcing secure coding policies that disallow dynamic shell construction in RPC or web handlers, verified via automated code review tools in CI/CD.
- Conducting focused penetration tests and fuzzing of HTTP/RPC endpoints with special characters, command separators, and unexpected parameter values to identify injection behavior.
