Vulnerability Details CVE-2025-67089
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.0%
CVSS Severity
CVSS v3 Score 8.1
References
Products affected by CVE-2025-67089
-
cpe:2.3:h:gl-inet:gl-axt1800:-
-
cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.2.0
-
cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.4
-
cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.8