CVE-2025-67089: GL-iNet GL-AXT1800 RCE Vulnerability

CVE-2025-67089 Overview

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.install_package RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges on the affected device.

Critical Impact

Authenticated attackers can achieve root-level command execution on vulnerable GL-iNet GL-AXT1800 routers, potentially leading to complete device compromise, network pivot attacks, and persistent backdoor installation.

Affected Products

• GL-iNet GL-AXT1800 Router Firmware v4.6.8
• GL-iNet routers running vulnerable firmware versions with the plugins.install_package RPC method

Discovery Timeline

• 2026-01-08 - CVE-2025-67089 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67089

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as command injection. The flaw resides within the plugins.install_package RPC method exposed by the GL-iNet GL-AXT1800 router's management interface.

The vulnerability arises because the firmware fails to properly validate and sanitize user-supplied input when processing package installation requests. When an authenticated user submits a package name through the RPC interface, the input is passed directly to system shell commands without adequate filtering of shell metacharacters. This allows attackers to inject arbitrary shell commands that execute with the privileges of the router's underlying process—typically root on embedded devices.

The network-accessible nature of this vulnerability, combined with the low authentication requirements (any authenticated user can exploit it), makes this a significant threat to enterprise and home networks utilizing affected GL-iNet devices.

Root Cause

The root cause of CVE-2025-67089 is the absence of input sanitization in the plugins.install_package RPC method handler. The firmware does not strip or escape shell metacharacters such as semicolons (;), backticks, pipe characters (|), or command substitution sequences ($(...)) from the package name parameter before incorporating it into shell command strings. This architectural flaw allows user-controlled input to break out of the intended context and execute arbitrary commands.

Attack Vector

The attack is executed over the network by an authenticated attacker. The exploitation process involves:

1. The attacker authenticates to the GL-iNet GL-AXT1800 router's management interface using valid credentials
2. The attacker crafts a malicious request to the plugins.install_package RPC endpoint
3. The package name parameter is injected with shell metacharacters followed by arbitrary commands
4. The vulnerable firmware executes the injected commands with root privileges
5. The attacker gains complete control over the router, enabling data exfiltration, traffic interception, or lateral movement within the network

Since no public exploit code has been verified, the vulnerability mechanism is described in prose. For detailed technical analysis, refer to the Medium Blog on Command Injection and the GL.iNet Security Updates page.

Detection Methods for CVE-2025-67089

Indicators of Compromise

• Unusual outbound network connections from the router to unknown external IP addresses
• Unexpected processes running on the router, particularly those spawned by the web management interface
• Modified system files or unauthorized SSH keys added to the device
• Abnormal log entries in the router's RPC method call logs showing suspicious package names with shell metacharacters

Detection Strategies

• Monitor RPC endpoint access logs for the plugins.install_package method with unusual or malformed package name parameters
• Implement network-based detection for HTTP requests to the router management interface containing shell metacharacters (;, |, backticks, $())
• Deploy SentinelOne Singularity for IoT to detect anomalous behavior patterns on network devices
• Configure SIEM rules to alert on multiple failed or suspicious RPC calls to GL-iNet routers

Monitoring Recommendations

• Enable verbose logging on GL-iNet routers and forward logs to a centralized SIEM for analysis
• Conduct regular firmware integrity checks to detect unauthorized modifications
• Monitor network traffic from router management interfaces for command-and-control communication patterns
• Implement network segmentation to isolate router management interfaces from general user networks

How to Mitigate CVE-2025-67089

Immediate Actions Required

• Update GL-iNet GL-AXT1800 firmware to the latest version available from GL.iNet Security Updates
• Restrict access to the router's management interface to trusted IP addresses only
• Review and rotate authentication credentials for all router accounts
• Audit the device for signs of compromise before and after patching

Patch Information

GL-iNet has published security updates addressing this vulnerability. Administrators should visit the GL.iNet Security Updates page to download and apply the latest firmware for the GL-AXT1800 router. Ensure that firmware updates are verified using checksums provided by the vendor before installation.

Workarounds

• Disable remote management access and restrict the web interface to local network access only
• Implement firewall rules to block external access to the router's RPC endpoints
• Place the router behind an additional firewall or VPN to limit exposure of management interfaces
• Consider disabling the plugin installation functionality if not required for operations

If network-level restrictions must be applied, configure firewall rules to limit management interface access:

# Configuration example
# Restrict router management interface to specific trusted IP addresses
# Example iptables rules (apply on upstream firewall)
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP