Description

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-17T05:17:09.767Z",
  "pubdate": "2026-08-17T05:17:09.767Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the Firewall-management RPC component of GL.iNet BE9300 and MT6000 routers running firmware version 4.8.x. This security flaw stems from the insecure handling of input passed via the dest_port and dest_ip arguments during remote procedure call operations. Successful exploitation of this vulnerability allows unauthorized remote threat actors to execute arbitrary operating system commands with elevated privileges on the underlying host operating system.\nThe implications of this vulnerability are severe, potentially leading to complete system compromise, unauthorized access to sensitive network data, and persistent device manipulation. Because the attack vector can be initiated remotely, vulnerable routers exposed directly to wide area networks or accessible via compromised local networks face a significant risk of exploitation. The vendor has officially confirmed the existence of this vulnerability and established that exploitation requires no prior authentication if the vulnerable RPC endpoint is accessible.\nOrganizations and individual users operating affected GL.iNet hardware must take immediate remediation action to prevent potential security breaches. Mitigating this risk requires applying the vendor-supplied firmware upgrade, restricting administrative interfaces, and minimizing the network exposure of management and RPC services.",
  "technicalDetails": "The vulnerability resides in the Firewall-management RPC component of the GL.iNet BE9300 and MT6000 firmware versions 4.8.x. The root cause of the vulnerability is insufficient input validation and sanitization of parameters handled by the RPC backend. Specifically, user-supplied input passed through the dest_port and dest_ip arguments is improperly processed and subsequently concatenated or passed directly into system shell invocation functions without adequate neutralization of meta-characters.\nThe exploitation mechanism involves an attacker crafting a malicious payload containing shell control operators or command separators injected into the dest_port or dest_ip parameters. When the Firewall-management RPC component processes the incoming request, the underlying operating system executes the tainted string via a system shell interpreter. This results in the execution of arbitrary operating system commands injected by the attacker.\nThe attack flow proceeds as follows: First, the remote adversary identifies or establishes network connectivity to the target device's RPC interface. Second, the attacker formulates an RPC request targeting the Firewall-management component, embedding the command injection payload within the dest_port or dest_ip fields. Third, the targeted GL.iNet router receives the malformed request and routes the parameters to the vulnerable backend handler. Fourth, the backend executes the unsanitized input within a system shell context. Finally, the injected commands execute with the privilege level of the RPC daemon, achieving arbitrary code execution.\nThe affected component is the Firewall-management RPC handler within GL.iNet BE9300 and MT6000 running firmware versions 4.8.x. The vulnerability exhibits remote network exposure, allowing unauthenticated or remotely positioned threat actors to interact with the RPC interface depending on the device exposure configuration. Post-exploitation impact includes full administrative control over the router, the ability to intercept or redirect network traffic, installation of persistent backdoors, and lateral movement into connected internal networks."
}