Summary
A command injection vulnerability in the GL.iNet GL-MT3000 router allows crafted input to the remove_profile function in /cgi-bin/glc to be executed as system commands via the modem.so component.
When exposed remotely, this weakness can let an attacker run arbitrary commands on the device, leading to full compromise of the router and any traffic it handles.
Affected context
The issue occurs in GL.iNet GL-MT3000 devices where the web management interface and associated CGI endpoints are reachable to an attacker, either directly from the internet or through local network access.
Specifically, the remove_profile functionality in /cgi-bin/glc within the modem.so component processes user-controlled data without robust command construction safeguards.
The vulnerability is relevant in deployments that rely on web-based configuration of modem profiles and do not restrict access to the router's administrative interface.
Exploit preconditions
- Attack surface: HTTP/HTTPS interface exposing
/cgi-bin/glcon the GL-MT3000 router - Required access: Network-level ability to send requests to the router's web UI (WAN or LAN, depending on configuration)
- Trigger point: Invocation of the
remove_profilefunction with crafted parameters that are incorporated into shell command execution - Why exploitation is possible: User-supplied data is embedded into command lines without proper neutralization or separation from control characters, enabling injection of additional shell commands
Why this happens
The underlying bug follows the command injection pattern captured in CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), and is closely related to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
In abstract terms, a server-side function accepts user-controlled input and constructs shell commands or passes parameters to a command interpreter without enforcing strict validation, escaping, or using safe, parameterized APIs.
Because the command construction trusts the input and allows shell metacharacters or command separators, attackers can alter the intended command structure and cause arbitrary code execution under the router's privilege context.
Potential impact
- Remote attackers may execute arbitrary system commands on the router.
- The device configuration could be altered, reset, or locked to unauthorized users.
- Network traffic passing through the router can be monitored, redirected, or blocked.
- Malware or persistent backdoors could be installed on the router's firmware environment.
- The compromised router can be leveraged as a pivot point for attacks against internal network hosts.
General mitigation guidance
Effective mitigation focuses on eliminating direct shell command construction from user input and reducing the trust placed in web management traffic.
Common defensive patterns include:
- Replacing shell command concatenation with safer, parameterized system interfaces or dedicated APIs that separate code from data.
- Strictly validating and constraining profile identifiers and similar parameters to whitelisted formats (e.g., fixed character sets, length limits, and structural rules).
- Applying robust input neutralization when interaction with command interpreters is unavoidable, ensuring special characters and control sequences are not processed as commands.
- Running management processes with least privilege and minimizing the commands they can invoke to limit blast radius if a flaw emerges.
- Restricting external access to the administrative web interface through firewall rules, VPN, or management VLANs so that only trusted users can reach sensitive endpoints.
How teams detect issues like this
Organizations and vendors can detect similar command injection issues through:
- Static analysis that flags uses of shell execution APIs (e.g.,
system,popen, backticks) with unsanitized or concatenated user input. - Code review checklists that require explicit justification and defensive handling for any command-line construction in web or network-exposed components.
- Security testing that fuzzes CGI endpoints and management interfaces with payloads containing command separators and shell metacharacters to see if they alter system behavior.
- Policy-based enforcement in CI/CD pipelines to block deployment of code that uses risky command execution patterns without an approved safe wrapper.
- Incorporating automated SAST/DAST tools that specialize in detecting injection vulnerabilities in router and embedded web interface code.
