CVE-2023-29778

Deeper analysis

GL.iNET MT3000 firmware version 4.1.0 Release 2 contains an OS command injection vulnerability, tracked as CVE-2023-29778 with CWE-78, in the component located at /usr/lib/oui-httpd/rpc/logread. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and result in complete loss of confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the affected RPC endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over the router, enabling actions such as traffic interception, persistence installation, or lateral movement within attached networks.

Public references point to GL.iNET product information and a detailed technical write-up that demonstrates the injection via the nginx log retrieval function, though no official patch or mitigation guidance is included in the available sources. The associated EPSS score rose from a low baseline to a peak of 0.2816 before receding to its current value of 0.1224, indicating a period of increased exploitation interest after disclosure.