CVE-2025-2851

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. Affected is an unknown function of the file plugins.so of the component RPC Handler. The manipulation leads to buffer overflow. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

VendorProductVersions
GL.iNetGL-A1300 Slate Plus4.x
GL.iNetGL-AR300M16 Shadow4.x
GL.iNetGL-AR300M Shadow4.x
GL.iNetGL-AR750 Creta4.x
GL.iNetGL-AR750S-EXT Slate4.x
GL.iNetGL-AX1800 Flint4.x
GL.iNetGL-AXT1800 Slate AX4.x
GL.iNetGL-B1300 Convexa-B4.x
GL.iNetGL-B3000 Marble4.x
GL.iNetGL-BE3600 Slate 74.x
GL.iNetGL-E7504.x
GL.iNetGL-E750V2 Mudi4.x
GL.iNetGL-MT300N-V2 Mango4.x
GL.iNetGL-MT1300 Beryl4.x
GL.iNetGL-MT2500 Brume 24.x
GL.iNetGL-MT3000 Beryl AX4.x
GL.iNetGL-MT6000 Flint 24.x
GL.iNetGL-SFT1200 Opal4.x
GL.iNetGL-X300B Collie4.x
GL.iNetGL-X750 Spitz4.x
GL.iNetGL-X3000 Spitz AX4.x
GL.iNetGL-XE300 Puli4.x
GL.iNetGL-XE3000 Puli AX4.x

References

Timeline

Published
Apr 26, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-28524.7A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vulnCVE-2025-28536.5An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of CVE-2025-28548.8A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknowCVE-2025-28557.2A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function cheCVE-2025-285710.0Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A comprCVE-2025-28588.8Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make useCVE-2025-28599.8An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and mCVE-2025-28605.3SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have withiCVE-2025-28617.5SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that informatCVE-2025-28627.5SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or CVE-2025-28637.8Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthentiCVE-2025-28646.1SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device,
CVE-2025-2851: High severity, CVSS 8.0 | Vulnix