CVE-2025-67089

Name of the Vulnerable Software and Affected Versions GL-iNet GL-AXT1800 router firmware version 4.6.8

Description A command injection issue exists in the plugins.install package RPC method. The method does not properly sanitize user input in package names, allowing authenticated attackers to execute arbitrary commands with root privileges. The vulnerable parameter is the package name provided to the plugins.install package RPC method.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the plugins.install package RPC method.