PT-2026-1871 · Gl.Inet · Gl-Inet Ax1800

Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-67090

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions GL.Inet AX1800 versions 4.6.4 through 4.6.8

Description The LuCI web interface on GL.Inet AX1800 devices lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci). This allows an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface.

Recommendations Update to version 4.8.2 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-67090

Affected Products

Gl-Inet Ax1800

References · 8

• 🔥 https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51 · Exploit
• 🔥 https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67090 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67090 · Vendor Advisory
• https://twitter.com/CVEnew/status/2009300018243453244 · Twitter Post
• https://gl-inet.com/security · Note
• https://twitter.com/ZatezaloAleksa/status/2009289090751971839 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009408495716589590 · Twitter Post