CVE-2025-67091
published 2026-01-08CVE-2025-67091: An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located…
PriorityP340medium6.5CVSS 3.1
AVAACLPRNUINSUCHINAN
EPSS
2.98%
85.6th percentile
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gl-inet | ax1800_firmware | — | — |
| gl-inet | ax1800_firmware | — | — |
| gl-inet | ax1800_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS GL-iNet install_package Command Injection Attempt (CVE-2025-67091)
suricata·2026-01-08·CVSS 6.5
CVE-2025-67091 [MEDIUM] ET WEB_SPECIFIC_APPS GL-iNet install_package Command Injection Attempt (CVE-2025-67091)
ET WEB_SPECIFIC_APPS GL-iNet install_package Command Injection Attempt (CVE-2025-67091)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GL-iNet install_package Command Injection Attempt (CVE-2025-67091)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:4; content:"/rpc"; http.request_body; content:"|22|jsonrpc|22|"; content:"|22|id|22 3a|"; content:"1"; within:10; content:"|22|method|22 3a|"; content:"|22|call|22|"; within:10; content:"|22|params|22|"; content:"|22|plugins|22|"; content:"|22|install_package|22|"; fast_pattern; content:"|22|name|22|"; content:"|5b 22|"; within:10; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:cve,2025-67091; reference:url,aleksazatezalo.medium.com/
No public exploits indexed.
No writeups or analysis indexed.
https://aleksazatezalo.medium.com/critical-authentication-bypass-vulnerability-in-gl-inet-gl-axt1800-router-firmware-f19442ca721dhttps://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repubhttps://www.gl-inet.com/
2026-01-08
Published