8.1

CVE-2025-67089

Medienbericht
Exploit
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gl-inet ≫ Gl-axt1800 Firmware Version4.2.0
   Gl-inet ≫ Gl-axt1800 Version-
Gl-inet ≫ Gl-axt1800 Firmware Version4.6.4
   Gl-inet ≫ Gl-axt1800 Version-
Gl-inet ≫ Gl-axt1800 Firmware Version4.6.8
   Gl-inet ≫ Gl-axt1800 Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.43% 0.695
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://www.gl-inet.com/security-updates/
Vendor Advisory
https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
Third Party Advisory
Exploit
Press/Media Coverage