Description
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radius_address POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can inject arbitrary shell commands by submitting a POST request with crafted radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters along with save=1 and enable_radius=1 to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 (UTC).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Synway Information Engineering Co., Ltd. Synway SMG Gateway Management Software
Default version status: affected
0affected
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/synway/synwaysmg-radius-rce.yaml ↗
- https://mrxn.net/jswz/synway-9-2radius-rce.html ↗
- https://mp.weixin.qq.com/s/PyepoFSuQ63E3RnpQa9nsA ↗
- https://www.synway.net/ ↗
- https://www.vulncheck.com/advisories/synway-smg-gateway-management-software-os-command-injection-via-radius-address ↗