CVE-2025-67089

Опубликовано: 08 янв. 2026

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.install_package RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges

Ссылки

https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
Exploit
Third Party Advisory
Press/Media Coverage
https://www.gl-inet.com/security-updates/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.2.0:*:*:*:*:*:*:*

cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.4:*:*:*:*:*:*:*

cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.8:*:*:*:*:*:*:*

cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*

EPSS

Процентиль: 54%

0.00313

Низкий

8.1 High

CVSS3

Дефекты

CWE-77

Связанные уязвимости

GHSA-wxm8-fmqv-9x7q