PT-2026-1872 · Gl.Inet · Gl-Inet Ax1800

Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-67091

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GL.Inet GL.Inet AX1800 versions 4.6.4 and 4.6.8

Description An issue exists in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call within the GL.Inet AX1800. The script operates with root privileges when activated through the LuCI web interface or authenticated API calls related to package management. The code utilizes shell redirection to establish a lock file in the globally writable /tmp directory, potentially leading to unauthorized access or modification. The vulnerable script is triggered via API calls to manage packages.

Recommendations GL.Inet GL.Inet AX1800 version 4.6.4 should be updated. GL.Inet GL.Inet AX1800 version 4.6.8 should be updated.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-377

CWE-307

Related Identifiers

CVE-2025-67091

Affected Products

Gl-Inet Ax1800

References · 8

• 🔥 https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub · Exploit
• 🔥 https://aleksazatezalo.medium.com/critical-authentication-bypass-vulnerability-in-gl-inet-gl-axt1800-router-firmware-f19442ca721d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67091 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67091 · Vendor Advisory
• https://gl-inet.com · Note
• https://twitter.com/ZatezaloAleksa/status/2009289090751971839 · Twitter Post
• https://twitter.com/CVEnew/status/2009300019422093819 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009411055676469352 · Twitter Post