Unrated severityNVD Advisory· Published Jan 8, 2026· Updated Jan 8, 2026
CVE-2025-67089
CVE-2025-67089
Description
A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.install_package RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
Affected products
2- GL-iNet/GL-AXT1800 router firmwaredescription
- Range: = 4.6.8
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.