CVE-2025-67090
BaseFortify
Publication date: 2026-01-08
Last updated on: 2026-01-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gl-inet | ax1800_firmware | 4.2.0 |
| gl-inet | ax1800_firmware | 4.6.4 |
| gl-inet | ax1800_firmware | 4.6.8 |
| gl-inet | ax1800 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the LuCI web interface on Gl Inet GL.Inet AX1800 versions 4.6.4 and 4.6.8. The issue is that these versions lack rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci). This allows an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface, potentially enabling brute-force attacks.
How can this vulnerability impact me? :
The vulnerability can allow an attacker on the local network to repeatedly attempt to guess the admin password without restriction. This could lead to unauthorized access to the device's administrative interface, potentially compromising the device's security and control.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the GL.Inet AX1800 device firmware to version 4.8.2 or later, which contains the fix for this vulnerability. Until the upgrade is applied, restrict local network access to the authentication endpoint (/cgi-bin/luci) to trusted users only, and monitor for unusual authentication attempts to prevent brute-force attacks.