A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
References
| Link | Resource |
|---|---|
| https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub | Exploit Third Party Advisory Press/Media Coverage |
| https://www.gl-inet.com/security-updates/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
16 Jan 2026, 21:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.4:*:*:*:*:*:*:* cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.2.0:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.6.8:*:*:*:*:*:*:* |
|
| First Time |
Gl-inet gl-axt1800
Gl-inet Gl-inet gl-axt1800 Firmware |
|
| References | () https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub - Exploit, Third Party Advisory, Press/Media Coverage | |
| References | () https://www.gl-inet.com/security-updates/ - Vendor Advisory |
08 Jan 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
08 Jan 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-08 16:15
Updated : 2026-01-16 21:26
NVD link : CVE-2025-67089
Mitre link : CVE-2025-67089
CVE.ORG link : CVE-2025-67089
JSON object : View
Products Affected
gl-inet
- gl-axt1800
- gl-axt1800_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')