This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Unsanitized input in `radius_address` allows **OS Command Injection**. π **Consequences**: Remote Code Execution (RCE) on the target system.β¦
π‘οΈ **Root Cause**: **CWE-78** (OS Command Injection). The `sed` command directly interpolates user-controlled POST parameters (`radius_address`, etc.) without any sanitization or validation.β¦
π’ **Affected**: **Synway SMG Gateway Management Software** by Synway Information Engineering Co., Ltd. π¦ **Component**: The RADIUS configuration endpoint located at `/en/9-2radius.php`.
Q4What can hackers do? (Privileges/Data)
π **Capabilities**: Full **Remote Code Execution (RCE)**. ποΈ **Privileges**: The injected commands run with the privileges of the web server process.β¦
π **Threshold**: **LOW**. π« **Auth**: **Unauthenticated**. No login required. π **Access**: Remote attackers can send crafted POST requests directly to the internet-facing endpoint.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Exploitation**: **YES**. Publicly observed by **Shadowserver** on July 11, 2025. π **Proof**: Nuclei templates and technical descriptions (e.g., mrxn.net) are available, indicating active wild exploitation.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for the specific POST endpoint `/en/9-2radius.php`. π§ͺ **Test**: Send a POST request with `save=1`, `enable_radius=1`, and a malicious `radius_address` (e.g., containing `| whoami`).β¦
π οΈ **Fix**: The vendor page is listed, but **no official patch date** is provided in the data (Published: 2026-04-30). β οΈ **Status**: Assume **unpatched** until verified. Check vendor site for updates.
Q9What if no patch? (Workaround)
π§ **Workaround**: **Block external access** to `/en/9-2radius.php` via firewall/WAF. π« **Restrict**: Ensure the management interface is not exposed to the public internet. Disable RADIUS if not strictly necessary.
Q10Is it urgent? (Priority Suggestion)
π΄ **Urgency**: **CRITICAL**. π¨ **Priority**: **Immediate Action Required**. CVSS Score is **9.8** (Critical). Unauthenticated RCE is a top-tier threat. Patch or isolate immediately.