CVE-2025-67090
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The LuCI web interface on GL.Inet AX1800 Version 4.6.4 & 4.6.8 is vulnerable. It lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci), allowing an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface. Fix available in version 4.8.2.
Risk Assessment
An attacker on the local network could perform a brute-force attack on the admin password, potentially leading to device compromise. Organizations using GL.Inet AX1800 are exposed to unauthorized access.
Recommendation
Update GL.Inet AX1800 firmware to version 4.8.2 or later. In the meantime, restrict access to the admin interface and enforce strong passwords.
Other vulnerabilities in GL.Inet AX1800
See all- CVE-2026-18787High
A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.
- CVE-2025-67091Medium
In GL.iNet AX1800 versions 4.6.4 and 4.6.8, the opkg-call script at /usr/libexec/opkg-call is executed with root privileges when triggered via the LuCI web interface or authenticated API calls for package management. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Original NVD description (English source)
The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS