Skip to main content
CRITICAL

CVE-2025-71284

CVSS v3

9.8

CRITICAL

EPSS Score

5.7 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1

Technical details

Published
2026-04-30

Frequently asked questions

What is CVE-2025-71284?

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1

Is CVE-2025-71284 actively exploited?

Active exploitation of CVE-2025-71284 has not been confirmed. Its EPSS score was 5.7% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-71284?

CVE-2025-71284 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2025-71284 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database