CVE-2025-71284 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: April 30, 2026
Synway SMG Gateway Management Software - Command Injection
Published: April 30, 2026Updated: April 30, 2026KEVRemote Exploitable
Overview
Synway SMG Gateway Management Software contains a command injection caused by unsanitized interpolation of radius_address parameter in sed command at /en/9-2radius.php, letting unauthenticated remote attackers execute arbitrary code via crafted POST requests.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Unauthenticated remote attackers can execute arbitrary code, potentially leading to full system compromise.
Mitigation
Update to the latest version of Synway SMG Gateway Management Software.
References
- https://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsA
- https://mrxn.net/jswz/synway-9-2radius-rce.html
- https://www.synway.net/
- https://www.cve.org/CVERecord?id=CVE-2025-71284
- https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yaml
Related Resources
Details
- CVE ID
- CVE-2025-71284
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- command_injection
- Status
- unconfirmed
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H