CVE-2025-71284 -- CVSS 9.8 Vulnerability Briefing

CVE-2025-71284 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2025-71284 is an OS command injection vulnerability in Synway SMG Gateway Management Software, specifically within the RADIUS configuration endpoint at /en/9-2radius.php.

Technical Detail

The flaw exists in how the application processes the radius_address POST parameter in the RADIUS configuration endpoint; the parameter is insufficiently sanitized before being passed to an underlying OS command, allowing an attacker to inject arbitrary shell commands. A remote attacker with access to the affected endpoint can craft a malicious POST request to achieve unauthenticated or low-privilege remote code execution (RCE) on the underlying host. Successful exploitation would grant the attacker full control over the gateway management system, potentially enabling lateral movement into connected network infrastructure.

Exploitation Status

No known exploit code has been publicly observed as of this writing, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept or weaponized code has been confirmed. Given the critical CVSS score of 9.8 and the straightforward nature of command injection vulnerabilities, the barrier to exploitation is low and this status should be monitored closely.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Organizations operating telecom or VoIP gateway infrastructure should treat this as a high-priority exposure regardless of the absence of attribution, as gateway management systems are historically attractive targets for both espionage and disruptive actors.

What To Do

Apply any available vendor patch from Synway immediately, prioritizing internet-facing or network-accessible deployments of the SMG Gateway Management Software. If a patch is not yet available, restrict access to the /en/9-2radius.php endpoint via network-level controls such as firewall rules or web application firewall policies, and limit management interface exposure to trusted administrative networks only. Review web server and application logs for anomalous POST requests to the RADIUS configuration endpoint, particularly those containing shell metacharacters such as semicolons, pipes, backticks, or dollar signs in the radius_address field. Given the critical severity and the nature of the flaw, treat this as a patch-now priority for any affected deployment.