CVE-2025-44018 Security feature bypass in GL-AXT1800
An attacker can downgrade firmware via a man-in-the-middle attack on the OTA update mechanism, bypassing security protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-44018?
CVE-2025-44018 is a high-severity vulnerability in GL-Inet GL-AXT1800, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Weakness: CWE-295
Which versions are affected by CVE-2025-44018?
How do I fix CVE-2025-44018?
No fix has been published for CVE-2025-44018 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-44018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44018 exists.
Sources
Also known as GHSA-29pc-8vpc-xrwf.