OS Command Injection in Synway SMG Gateway Management Software
CVE-2025-71284

9.3CRITICAL

Key Information:

Vendor: Synway Information Engineering Co., Ltd.
Status: Synway Smg Gateway Management Software
Vendor: CVE Published:; 30 April 2026

🔔 Create Synway Information Engineering Co., Ltd. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-71284?

The Synway SMG Gateway Management Software is vulnerable to an OS command injection attack through its RADIUS configuration endpoint. This vulnerability arises due to insufficient input sanitization, allowing an unauthenticated remote attacker to execute arbitrary shell commands. By crafting a POST request with specific parameters, including radius_address and shared_secret2, an attacker can manipulate the command executed by the server, leading to potential remote code execution. It is crucial for users of the Synway SMG Gateway Management Software to apply necessary security measures to mitigate this vulnerability.

Affected Version(s)

Synway SMG Gateway Management Software 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-71284 - Proof of Concept