CVE-2025-2851: GL.iNet Routers Buffer Overflow Vulnerability

CVE-2025-2851 Overview

CVE-2025-2851 is a buffer overflow vulnerability affecting a broad range of GL.iNet routers running firmware version 4.x. The flaw resides in an unspecified function within the plugins.so shared object, which is part of the router's RPC Handler component. An attacker on an adjacent network with low privileges can trigger the overflow to compromise device confidentiality, integrity, and availability. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). GL.iNet has published firmware updates through its security advisory.

Critical Impact
Adjacent-network attackers with low privileges can trigger a buffer overflow in the RPC Handler to compromise the router across confidentiality, integrity, and availability.

Affected Products

GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate firmware 4.x
GL.iNet GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7 firmware 4.x
GL.iNet GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli, GL-XE3000 Puli AX firmware 4.x

Discovery Timeline

2025-04-26 - CVE-2025-2851 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2851

Vulnerability Analysis

The vulnerability affects the RPC Handler component implemented in the plugins.so shared library on GL.iNet routers. GL.iNet's firmware exposes RPC endpoints that handle configuration, plugin invocation, and system control on the LuCI/OpenWrt-derived management stack. An unknown handler function fails to constrain input to its destination buffer, producing a buffer overflow condition. Successful exploitation grants full impact on confidentiality, integrity, and availability of the affected device. Because routers sit at the network perimeter and typically hold administrative credentials, exploitation enables persistent foothold, traffic interception, and lateral pivoting into connected client networks.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119] inside a handler function of plugins.so. Vendor and third-party disclosures do not identify the exact function or field, but the defect allows attacker-controlled data to write past an allocated buffer during RPC message processing. GL.iNet's April 2025 security advisory addresses this class of issue in its 4.x firmware branch.

Attack Vector

The attack vector is adjacent network, meaning the attacker must be present on the same logical network segment as the router, such as a connected Wi-Fi client, guest network, or LAN. Authentication is required at a low privilege level, and no user interaction is needed. An authenticated low-privilege user on the router's management interface can send a crafted RPC request to plugins.so to trigger the overflow. The vulnerability described here concerns memory corruption via crafted RPC input; no verified public exploit code is available at the time of writing. See the GL.iNet security advisory and VulDB entry 306288 for reference details.

Detection Methods for CVE-2025-2851

Indicators of Compromise

Unexpected reboots, crashes, or plugins.so faults recorded in router logread output or dmesg ring buffer
Presence of new or unfamiliar accounts, SSH keys, or cron entries under /etc/ and /root/
Outbound connections from the router itself to unknown hosts, which typically only originates locally for firmware/OpenWrt package fetches

Detection Strategies

Monitor firmware version reporting for devices still on GL.iNet 4.x releases prior to the fixed builds listed in the vendor advisory
Inspect authenticated RPC traffic to /rpc and /cgi-bin/ endpoints on the router management interface for oversized or malformed payloads
Compare running configuration and installed plugins against a known-good baseline to detect tampering

Monitoring Recommendations

Forward router syslog to a central collector and alert on repeated RPC handler crashes or segmentation faults
Restrict management-plane access to a dedicated administrative VLAN and monitor for lateral movement from user segments
Track DHCP, ARP, and Wi-Fi association logs to identify unauthorized adjacent-network devices capable of reaching the router API

How to Mitigate CVE-2025-2851

Immediate Actions Required

Upgrade all affected GL.iNet 4.x devices to the firmware release listed in the GL.iNet April 2025 security advisory
Rotate administrator credentials and any API tokens after patching, since low-privilege accounts are within the exploitation scope
Disable remote management and restrict the LuCI/RPC interface to a trusted management VLAN

Patch Information

GL.iNet has published fixed firmware for the affected 4.x product lines. Refer to the vendor's security advisories page for the specific patched build corresponding to each model. Apply updates through the router web UI under System > Upgrade, or via the vendor's OTA channel.

Workarounds

Segment untrusted clients onto isolated guest networks that cannot reach the router management IP or RPC endpoints
Enforce strong, unique passwords on all router accounts to reduce the pool of low-privilege users capable of triggering the flaw
Disable unused services and plugins in the router configuration to reduce the exposed RPC surface

bash

# Configuration example: restrict router management to a trusted VLAN on OpenWrt/GL.iNet
uci set firewall.@zone[0].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-Mgmt-VLAN'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].src_ip='192.168.10.0/24'
uci set firewall.@rule[-1].dest_port='80 443 22'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart