CVE-2025-71284 Synway SMG Gateway Management Software OS Command Injection via radius_address
Unauthenticated attackers can execute arbitrary shell commands on Synway SMG Gateways via the radius_address parameter in the RADIUS configuration endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-71284?
CVE-2025-71284 is a critical command injection vulnerability in Synway SMG Gateway Management Software, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
Weakness: CWE-78
Which versions are affected by CVE-2025-71284?
It affects 1 product.
Products include Synway Smg Gateway Management Software.
How do I fix CVE-2025-71284?
No fix has been published for CVE-2025-71284 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-71284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71284 exists.
Sources
Also known as GHSA-8mvw-jrmp-qqqj.