SecuriTricks - CVE-2025-67090

Description

The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.

Product(s) Impacted

Vendor	Product	Versions
Gl-inet	Gl.inet Ax1800	4.6.4, 4.6.8, 4.8.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	gl-inet	gl.inet_ax1800	4.6.4	/	/	/	/	/	/	/
a	gl-inet	gl.inet_ax1800	4.6.8	/	/	/	/	/	/	/
a	gl-inet	gl.inet_ax1800	4.8.2	/	/	/	/	/	/	/

References

https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51

https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub

https://www.gl-inet.com/security/

CVSS Score

5.1 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

View Vector String

Timeline

Published: Jan. 8, 2026, 4:15 p.m.
Last Modified: Jan. 8, 2026, 6:08 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2025-67090