CVE-2025-1448
Published: 19 February 2025
Summary
CVE-2025-1448 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A command injection vulnerability rated critical affects Synway SMG Gateway Management Software up to version 20250204. The flaw resides in an unspecified processing routine within the file 9-12ping.php, where unsanitized input to the retry argument permits arbitrary command execution. The issue is tracked under CWE-74 and CWE-77 and carries a CVSS 4.0 score of 6.9 reflecting network-accessible attack conditions without authentication or user interaction.
Remote, unauthenticated attackers can supply crafted parameters to the affected endpoint and execute operating-system commands on the gateway host. Successful exploitation yields limited but direct control over confidentiality, integrity, and availability of the management interface and underlying system; a functional exploit has already been published.
No vendor patch or mitigation guidance has been issued, as the supplier did not respond to disclosure attempts. Public references including a GitHub proof-of-concept and Vuldb entries document the flaw and the absence of an official fix.
The associated EPSS score rose from a baseline of 0.0091 to a peak of 0.0174, indicating measurable post-disclosure interest in exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4756
Vulnerability details
A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing of the file 9-12ping.php. The manipulation of the argument retry leads to command injection. The…
more
attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in publicly accessible management web interface (9-12ping.php) enables remote unauthenticated RCE, directly mapping to T1190 for initial access and T1059.004 for Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents command injection by enforcing validation of untrusted inputs like the 'retry' argument in 9-12ping.php.
SI-2 ensures timely identification, reporting, and correction of the command injection flaw in Synway SMG Gateway Management Software.
SC-7 implements boundary protections such as web application firewalls to monitor and block remote command injection exploits targeting the vulnerable endpoint.