CVE-2025-71284: Critical RCE in Synway SMG Gateway Management Software

The National Vulnerability Database has detailed CVE-2025-71284, a critical OS command injection vulnerability in Synway SMG Gateway Management Software. Specifically, the RADIUS configuration endpoint at /en/9-2radius.php is vulnerable. The radius_address POST parameter, along with others like radius_address2, shared_secret2, source_ip, timeout, and retry, are directly interpolated into a sed command without proper sanitization.

This flaw allows an unauthenticated remote attacker to inject arbitrary shell commands by sending a crafted POST request. The impact is severe, enabling remote code execution (RCE) with a CVSS score of 9.8. The Shadowserver Foundation first observed exploitation evidence for this vulnerability on July 11, 2025.

Defenders must recognize the gravity of unauthenticated RCE. This isn’t theoretical; it’s a direct path for attackers to gain full control over affected gateways. The lack of specified affected products by the National Vulnerability Database means organizations using Synway SMG Gateway Management Software must assume they are at risk unless proven otherwise.