Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-67089 Details

Description

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub	[email protected]	ExploitPress/Media CoverageThird Party Advisory
https://www.gl-inet.com/security-updates/	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-77	Improper Neutralization of Special Elements used in a Command ('Command Injection')	CISA-ADP

Affected Products

Product	Versions
gl-inet gl-axt1800 firmware	4.2.0 4.6.4 4.6.8
CPE cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.2.0:::::::* cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.4:::::::* cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.8:::::::* Remediation No remediation found in references.
gl-inet gl-axt1800	All versions
CPE cpe:2.3:h:gl-inet:gl-axt1800:-:::::::* Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Jan 16, 2026	Initial Analysis	[email protected]
Jan 8, 2026	CVE Modified	CISA-ADP
Jan 8, 2026	New CVE Received	[email protected]