CVE-2025-29269

published 2025-12-04

CVE-2025-29269: ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.

Priority P2 72 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
allnet	all-rut22gw_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-bin/popen.cgi?

path /cgi-bin/popen.cgi↗

url blog.byteray.co.uk/critical-vulnerabilities-in-rut22gw-industrial-lte-cellular-routers-f4eb8768feb7

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Allnet ALL-RUT22GW 4G LTE Cellular Router Unauthenticated Remote Code Execution (CVE-2025-29269)"; flow:established,to_server; http.uri; content:"/cgi-bin/popen.cgi?"; fast_pattern; content:"command|3d|"; reference:url,blog.byteray.co.uk/critical-vulnerabilities-in-rut22gw-industrial-lte-cellular-routers-f4eb8768feb7; reference:cve,2025-29269; classtype:web-application-attack; sid:2066031; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2025_12_05, cve CVE_2025_29269, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_12_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Detect HTTP requests to the vulnerable endpoint by matching URI path '/cgi-bin/popen.cgi?' combined with the 'command=' parameter (URL-encoded as 'command|3d|') in the query string — this is the injection vector for unauthenticated RCE.
• → The exploit is unauthenticated and targets inbound HTTP traffic to the server; deploy the Snort/Suricata rule on perimeter, internal, and SSLDecrypt (TLS-decrypting) sensors for full coverage.
• → Map detections to MITRE ATT&CK T1190 (Exploit Public-Facing Application) under tactic TA0001 (Initial Access).

• · The Snort/Suricata rule (sid:2066031) requires TLS inspection ('tls_state TLSDecrypt') to detect exploitation over HTTPS; without SSL/TLS decryption, HTTPS-based attacks will be missed.
• · Affected version is specifically ALLNET ALL-RUT22GW v3.3.8; scope detection and patching efforts to devices running this firmware version. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78