Orta CVSS 6.5 PoC var
CVE-2025-67091: Ax1800 Firmware: güvenlik açığı
Açıklama (NVD)
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Özet bilgiler
- Ürün
- Gl-inet Ax1800 Firmware
- CVSS v3.1
- 6.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %3,30 (yüzdelik 89)
- CWE
- CWE-307
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| gl-inet-ax1800-firmware | 4.2.0 | 4.2.0 | — |
| gl-inet-ax1800-firmware | 4.6.4 | 4.6.4 | — |
| gl-inet-ax1800-firmware | 4.6.8 | 4.6.8 | — |