CVE-2025-67091: GL.iNet AX1800 Privilege Escalation Flaw

CVE-2025-67091 Overview

A race condition vulnerability exists in the GL.iNet AX1800 router firmware versions 4.6.4 and 4.6.8 within the custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory, creating an exploitable race condition that could allow an adjacent network attacker to access sensitive information.

Critical Impact

An adjacent network attacker can exploit this race condition vulnerability to potentially access sensitive information on affected GL.iNet AX1800 routers without authentication.

Affected Products

• GL.iNet AX1800 Router Firmware Version 4.6.4
• GL.iNet AX1800 Router Firmware Version 4.6.8

Discovery Timeline

• 2026-01-08 - CVE-2025-67091 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67091

Vulnerability Analysis

This vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), though the core issue relates to insecure file handling practices. The affected opkg wrapper script at /usr/libexec/opkg-call runs with elevated root privileges and creates lock files in the world-writable /tmp directory using shell redirection.

The fundamental flaw lies in the script's use of an insecure location for lock file management. Since /tmp is world-writable, any user or process on the system can potentially interact with files in this directory. When the opkg wrapper creates its lock file, an attacker on the adjacent network could exploit the timing window between lock file creation and use.

Root Cause

The root cause stems from insecure file handling in the opkg wrapper script. The script uses shell redirection to create lock files in /tmp, a world-writable directory, rather than using a secure, restricted location with proper permissions. This design choice violates the principle of least privilege and creates a race condition window that can be exploited by attackers with adjacent network access.

The LuCI web interface and authenticated API endpoints trigger this script when managing packages, providing an attack surface for exploitation. The lack of proper file locking mechanisms and the use of predictable file locations in world-writable directories compound the security risk.

Attack Vector

An attacker positioned on the adjacent network can exploit this vulnerability without requiring any authentication or user interaction. The attack leverages the timing window created when the root-privileged script interacts with files in the /tmp directory.

The exploitation scenario involves:

1. An attacker monitors the /tmp directory for lock file creation events
2. When the vulnerable script is triggered via LuCI or API calls, the attacker races to manipulate the lock file
3. By winning the race condition, the attacker can potentially access sensitive information or influence the script's behavior

Technical details and additional security research can be found in the Medium Article on Authentication Bypass and Medium Article on Command Injection documenting related vulnerabilities in this router firmware.

Detection Methods for CVE-2025-67091

Indicators of Compromise

• Unusual file activity or unexpected symbolic links appearing in the /tmp directory
• Multiple rapid access attempts to the /usr/libexec/opkg-call script from non-administrative sources
• Unexpected lock file creation patterns in /tmp coinciding with package management operations
• Anomalous network connections from adjacent network addresses to the LuCI web interface

Detection Strategies

• Monitor file system events in the /tmp directory for suspicious lock file manipulation
• Implement network-level monitoring to detect unusual adjacent network traffic to the router's management interfaces
• Review authentication logs for the LuCI interface and API endpoints for abnormal access patterns
• Deploy file integrity monitoring on the /usr/libexec/opkg-call script to detect unauthorized modifications

Monitoring Recommendations

• Enable detailed logging for all package management operations via LuCI and API
• Configure alerts for race condition indicators such as rapid file creation/deletion in /tmp
• Monitor for unauthorized adjacent network devices attempting to access management interfaces
• Implement network segmentation to limit adjacent network attack surface

How to Mitigate CVE-2025-67091

Immediate Actions Required

• Restrict network access to the router's management interfaces (LuCI and API) to trusted hosts only
• Isolate the affected GL.iNet AX1800 router from untrusted adjacent network segments
• Disable package management features via the web interface if not actively required
• Monitor for firmware updates from GL.iNet that address this vulnerability

Patch Information

As of the last NVD update on 2026-01-08, no official patch has been documented. Users should monitor the GL.iNet Official Website for security advisories and firmware updates addressing this vulnerability. Check for firmware versions newer than 4.6.8 that may contain security fixes.

Workarounds

• Implement network access controls to restrict adjacent network access to the router's management ports
• Configure firewall rules to limit which IP addresses can access the LuCI web interface
• Disable the web-based package management interface if not required for operations
• Consider using VPN or other secure channels for remote router administration

# Example: Restrict access to LuCI management interface
# Add firewall rules to limit management access
uci add firewall rule
uci set firewall.@rule[-1].name='Limit_LuCI_Access'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].target='ACCEPT'
uci set firewall.@rule[-1].src_ip='192.168.1.100'
uci commit firewall
/etc/init.d/firewall restart