CVE-2025-71284
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
View on NVDAnalysis
This is an unauthenticated remote code execution vulnerability in Synway SMG Gateway management software. While the severity is critical and it is being exploited in the wild, the product is specialized telecom hardware that is not commonly used within the general software development or DevOps community.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCWE-78EPSS
Affects
synway:smg_gateway_management_softwareTechnical description
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yaml
- https://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsA
- https://mrxn.net/jswz/synway-9-2radius-rce.html
- https://www.synway.net/
- https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address