GL.iNet Ax1800 Firmware vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting GL.iNet Ax1800 Firmware: 2 record(s), with affected versions and fixes.cpe:2.3:o:gl-inet:ax1800_firmware
CVE-2025-67091
Medium · 6.5
CWE-307 Jan 8, 2026
Improper Restriction of Excessive Authentication Attempts in GL.iNet Ax1800 Firmware
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
CVE-2025-67090
Medium · 5.1
CWE-307 Jan 8, 2026
Improper Restriction of Excessive Authentication Attempts in GL.iNet Ax1800 Firmware
The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.