CVE-2025-67089

moderate-risk
Published 2026-01-08

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges

Do I need to act?

-
0.34% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Gl-Inet

References (2)

Exploit https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl...
Vendor Advisory https://www.gl-inet.com/security-updates/
38
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 1/34 · Minimal
Exposure 9/34 · Low