Read the docs
TI-2025-28567 Aliases CVE-2025-44018GHSA-29pc-8vpc-xrwf

Improper certificate validation in GL.iNet GL-AXT1800

Priority HIGH 71CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GL.iNetGL-AXT18004.7.0—No fix listedCNA
  • GL-AXT1800 VendorGL.iNet Affected 4.7.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-44018
  2. 2026-10-03 Alias added: GHSA-29pc-8vpc-xrwf

References

Other 1

  • TI-2026-21387 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2024-26219 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750… CVSS 3.1CRITICAL 9.8
  • TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
  • TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
  • TI-2023-14015 GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. CVSS 3.1CRITICAL 9.8
  • TI-2026-15312 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection CVSS 4.0CRITICAL 9.3
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences