CVE-2025-71284
Published: 30 April 2026
Description
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject…
more
arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents OS command injection by ensuring POST parameters like radius_address are sanitized before interpolation into the sed command.
Flaw remediation addresses the vulnerability comprehensively by applying vendor patches or fixes to eliminate the unsanitized command interpolation.
Boundary protection with web application firewalls or proxies can filter and block crafted POST requests to the vulnerable /en/9-2radius.php endpoint.
Security SummaryAI
CVE-2025-71284 is an OS command injection vulnerability (CWE-78) in Synway SMG Gateway Management Software, affecting the RADIUS configuration endpoint at /en/9-2radius.php. The issue arises because the radius_address POST parameter is split and interpolated directly into a sed command without sanitization, allowing injection of arbitrary shell commands. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-30.
An unauthenticated remote attacker can exploit this vulnerability by submitting a crafted POST request to the endpoint with parameters such as radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry, along with save=1 and enable_radius=1. Successful exploitation achieves remote code execution on the targeted system.
Advisories and related resources, including those from VulnCheck and a Nuclei template on GitHub, detail the vulnerability and provide detection methods; the vendor site at synway.net should be consulted for any patches or updates. Additional technical analyses are available at mrxn.net and mp.weixin.qq.com.
Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC), indicating real-world activity prior to official publication.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection in a public-facing web endpoint (/en/9-2radius.php) enables remote code execution, directly mapping to T1190 (Exploit Public-Facing Application) and facilitating arbitrary Unix Shell command execution (T1059.004).