PT-2025-35785 · Boa+1 · Boa+1

Jorge2Rubio · Published 2025-09-03 · Updated 2025-09-06 · CVE-2025-56498

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PLDT WiFi Router Prolink PGN6401V Firmware version 8.1.2

Description An OS command injection flaw exists in the web management interface. The ping6.asp page submits user input to the /boaform/formPing6 API endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can inject arbitrary system commands, which are executed with root privileges. The router uses the Boa web server version 0.93.15 to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.

Recommendations Firmware version 8.1.2 should be updated when a fixed version is available. As a temporary workaround, restrict access to the ping6.asp page. Sanitize the pingAddr parameter to prevent command injection.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-56498

Affected Products

Boa

Pldt Wifi Router Prolink Pgn6401V

References · 7

• 🔥 https://github.com/Jorge2Rubio/CVEs/blob/main/CVE-2025-56498.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-56498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56498 · Security Note
• https://twitter.com/CVEnew/status/1963275364089594044 · Twitter Post
• https://twitter.com/SecAideInfo/status/1964270487564849296 · Twitter Post
• https://twitter.com/ET_Labs/status/1963338797573181539 · Twitter Post
• https://prolink2u.com/products/pgn6401v · Note