CVE-2025-67091
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
In GL.iNet AX1800 versions 4.6.4 and 4.6.8, the opkg-call script at /usr/libexec/opkg-call is executed with root privileges when triggered via the LuCI web interface or authenticated API calls for package management. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Risk Assessment
The vulnerable mechanism could be abused for privilege escalation or disruption of package management by a local or authenticated attacker. The risk affects edge devices with administrative panel access.
Recommendation
Update the GL.iNet AX1800 firmware to a version containing the fix. Restrict access to the LuCI interface and API, and consider moving the lock file outside the /tmp directory.
Other vulnerabilities in GL.iNet AX1800
See all- CVE-2026-18787High
A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.
- CVE-2025-67090Medium
The LuCI web interface on GL.Inet AX1800 Version 4.6.4 & 4.6.8 is vulnerable. It lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci), allowing an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface. Fix available in version 4.8.2.
Original NVD description (English source)
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS