Summary
GL.iNet GL-MT3000 routers up to firmware version 4.4.5 contain a command injection flaw in the set_upgrade function of /cgi-bin/glc within the modem.so component.
A remote attacker can inject and execute arbitrary system commands by abusing this upgrade interface when malicious input is passed to the affected CGI endpoint.
Affected context
The vulnerability occurs in the web-based management interface of GL.iNet GL-MT3000 routers running firmware up to 4.4.5.
It specifically affects the set_upgrade functionality exposed via the /cgi-bin/glc endpoint implemented in modem.so.
The issue arises when user-supplied data is combined with shell commands without robust validation or escaping, making devices that expose or forward access to the HTTP admin surface particularly susceptible.
Exploit preconditions
- Attack surface: HTTP(S) interface of the router, via the
/cgi-bin/glcendpoint. - Required access: Ability to send crafted requests to the management interface (this may be LAN-only, VPN-restricted, or Internet-exposed depending on configuration).
- Trigger point: Invocation of the
set_upgradefunctionality with attacker-controlled parameters that are passed to underlying system commands. - Why exploitation is possible: The input used by
set_upgradeis incorporated into shell commands without proper sanitization, validation, or safe parameterization, allowing arbitrary command sequences to be executed by the system shell.
Why this happens
This vulnerability stems from improper handling of user input that is passed to command-line interpreters.
The affected set_upgrade function appears to construct shell commands by concatenating or interpolating parameters derived from HTTP request data and executing them via system-level APIs.
This pattern aligns with CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') and is closely related to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, because untrusted data is placed into a command context without correctly neutralizing metacharacters.
Potential impact
- Remote execution of arbitrary OS commands on the router.
- Complete compromise of the device, including configuration, routing rules, and stored credentials.
- Use of the router as a pivot point for attacks against internal network systems.
- Interception, manipulation, or redirection of network traffic traversing the device.
- Deployment of persistent malware or participation in botnets.
General mitigation guidance
Effective mitigation focuses on removing the ability for untrusted data to influence shell commands and reducing the impact of any compromise.
General defensive patterns include:
- Avoiding direct shell invocation for web-layer operations and using high-level APIs or libraries instead of constructing shell command strings.
- Applying strict input validation and whitelisting for all parameters influencing system-level operations, especially firmware or modem upgrade routines.
- If shell commands must be used, passing parameters via safe, non-interpreted argument vectors rather than concatenated strings.
- Running web and upgrade components with the least privileges necessary, and isolating them from sensitive subsystems.
- Restricting access to the management interface to trusted networks and disabling remote administration when not required.
How teams detect issues like this
Organizations and maintainers can detect this class of issue using several approaches:
- Static analysis: Scan for calls to shell-executing APIs (e.g., system, popen, exec* wrappers) where arguments are built from HTTP parameters or other untrusted inputs.
- Code review: Look for CGI handlers and upgrade routines that construct command strings, especially where concatenation or string formatting is used instead of parameterized interfaces.
- Dynamic testing: Use web application security testing tools and fuzzers configured to probe CGI endpoints for command injection patterns and anomalous responses.
- Policy enforcement: Adopt secure coding guidelines that forbid direct shell invocation from web handlers and require peer review for any code touching firmware or modem control paths.
