{"id":"CVE-2025-67090","aliases":["EUVD-2026-1507","GHSA-jjmx-7vpw-fcc5"],"status":"published","title":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix...","description":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-07","score":0.00245,"percentile":0.15822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-307"],"published":"2026-01-08T00:00:00Z","modified":"2026-11-04T22:10:00Z","products":[{"vendor":"gl-inet","product":"ax1800_firmware"}],"references":[{"url":"https://www.gl-inet.com/security/","tags":["Broken Link"]},{"url":"https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67090"},{"url":"https://www.gl-inet.com/security"},{"url":"https://github.com/advisories/GHSA-jjmx-7vpw-fcc5"}],"sources":{"cve":[{"id":"CVE-2025-67090","description":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.","status":"published","published":"2026-01-08T00:00:00Z","modified":"2026-01-08T16:51:52.244Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2026-1507","description":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.","status":"published","published":"2026-01-08T00:00:00Z","modified":"2026-01-08T16:51:52Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:54.487856Z"}],"ghsa":[{"id":"GHSA-jjmx-7vpw-fcc5","title":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix...","description":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.","status":"published","published":"2026-01-08T18:30:49Z","modified":"2026-01-08T18:30:56Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:05:32.392087Z"}],"nvd":[{"id":"CVE-2025-67090","description":"The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 \u0026 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.","status":"published","published":"2026-01-08T16:15:45.47Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-04T23:43:38.567042Z"}]}}