PT-2025-54455 · Unknown · Gargoyle Router

Published 2025-12-31 · Updated 2026-01-02 · CVE-2015-10145

Positive Technologies · (AI Summary)

CVSS v4.0

8.7

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Gargoyle router management utility versions 1.5.x

Description The application does not properly restrict or validate input provided through the

commands

parameter, leading to authenticated OS command execution. This occurs in the /utility/run commands.sh script. Successful exploitation could lead to a full compromise of the device, including unauthorized access to system files and execution of attacker-controlled commands.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2015-10145

Affected Products

Gargoyle Router

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-10145 · Security Note
• https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en · Note
• https://t.me/CVEtracker/41125 · Telegram Post
• https://t.me/cveNotify/147407 · Telegram Post
• https://t.me/cveNotify/147552 · Telegram Post
• https://packetstorm.news/files/id/132149 · Note
• https://vulncheck.com/advisories/gargoyle-authenticated-os-command-execution-via-run-commands-sh · Note
• https://gargoyle-router.com · Note