CVE-2025-71284
OS Command Injection in Synway SMG Gateway Management Software
Publication date: 2026-04-30
Last updated on: 2026-05-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synway | smg_gateway_management_software | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-71284 is a critical OS command injection vulnerability in the Synway SMG Gateway Management Software, specifically in the RADIUS configuration endpoint at /en/9-2radius.php.
The vulnerability arises because the radius_address POST parameter (and others like radius_address2, shared_secret2, source_ip, timeout, retry) are directly interpolated into a sed command without proper sanitization.
An unauthenticated remote attacker can exploit this by sending a specially crafted POST request with these parameters along with save=1 and enable_radius=1, allowing them to inject arbitrary shell commands and achieve remote code execution on the server.
This flaw was first observed being exploited in the wild by the Shadowserver Foundation on July 11, 2025.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the affected server remotely.
Successful exploitation can lead to full compromise of the server, including installing backdoors, gaining unauthorized access, and taking control of the entire web server.
Such control can result in data theft, service disruption, or using the compromised server as a pivot point for further attacks within a network.
Because no authentication is required, the risk is especially high for exposed systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the /en/9-2radius.php endpoint with parameters such as radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry, combined with save=1 and enable_radius=1, to check for command injection.
Detection tools like Nuclei and Afrog can be used with available Proof of Concept (POC) scripts to identify the vulnerability.
A specific example includes sending a POST request with a payload in the radius_address parameter that injects shell commands, such as using a semicolon or command separator to execute commands like 'id' or reading files like /etc/passwd.
For example, using Nuclei with the provided template for this vulnerability can help detect it automatically.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include contacting the vendor to obtain and apply official patches for the Synway SMG Gateway Management Software.
Implementing a web application firewall (WAF) to block malicious POST requests targeting the vulnerable endpoint can help reduce risk.
Restricting internet exposure of the affected management interface and limiting access permissions to trusted networks or users is recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote attackers to execute arbitrary shell commands on the affected system, leading to remote code execution.
Such a critical security flaw can lead to unauthorized access, data breaches, and potential compromise of sensitive information.
This poses a significant risk to compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Organizations using the affected software must address this vulnerability promptly to maintain compliance and avoid legal and financial penalties associated with data breaches.