Strforexc2

**Name of the Vulnerable Software and Affected Versions** GL-iNet GL-MT3000 versions prior to 4.4.6 **Description** Command injection is possible via the `wg-server.generate publickey()` function within the `/cgi-bin/glc` file of the `wg-server.so` Native Plugin. A remote attacker can trigger this by manipulating the `private key` argument. **Recommendations** Update GL-iNet GL-MT3000 to version 4.4.6 or later. As a temporary mitigation, restrict access to the `wg-server.generate publickey()` function.

**Name of the Vulnerable Software and Affected Versions** GL-iNet GL-MT3000 versions prior to 4.4.6 **Description** Command injection is possible via remote exploitation in the wg-server.so Native Plugin. The issue exists within the `server.set peer()` function located in the `/cgi-bin/glc` file, where improper handling of the `public key` variable allows for the execution of arbitrary commands. **Recommendations** Update GL-iNet GL-MT3000 to version 4.4.6 or later. As a temporary mitigation, restrict access to the `/cgi-bin/glc` endpoint to prevent unauthorized manipulation of the `public key` variable.

**Name of the Vulnerable Software and Affected Versions** GL.iNet GL-MT3000 versions prior to 4.4.6 **Description** An issue exists in the `modem.so` component due to insufficient input validation. A remote attacker can exploit this to perform command injection via the `remove profile()` function at the '/cgi-bin/glc' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device. **Recommendations** Update to a version newer than 4.4.5. As a temporary workaround, restrict access to the '/cgi-bin/glc' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GL.iNet GL-MT3000 versions prior to 4.4.6 **Description** An issue exists in the `modem.so` component due to a lack of input sanitization. This allows a remote attacker to perform command injection via the `set upgrade()` function within the '/cgi-bin/glc' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the target machine. **Recommendations** Update to a version newer than 4.4.5. As a temporary workaround, restrict access to the '/cgi-bin/glc' endpoint to minimize the risk of exploitation.