CVE-2025-71284
9.8
CRITICAL · CVSS 3.1 · EPSS 5.7% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.73% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2026-04-30 |
| Last modified | 2026-10-07 |
Affected (1)
| Vendor | Product |
|---|---|
| synway | smg gateway management software |
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yaml
- https://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsA
- https://mrxn.net/jswz/synway-9-2radius-rce.html
- https://www.synway.net/
- https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address
→ the Explorer · watch your stack · NVD