CVE-2025-71284 is an OS command injection vulnerability in Synway SMG Gateway Management Software's RADIUS configuration endpoint (/en/9-2radius.php). The vulnerability occurs because the radius_address POST parameter and several others are split and interpolated directly into a sed command without proper sanitization. This allows an unauthenticated remote attacker to inject arbitrary shell commands by submitting crafted POST requests with specific parameters (radius_address, radius_address2, shared_secret2, source_ip, timeout, retry) along with save=1 and enable_radius=1. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. Exploitation evidence was first reported by Shadowserver Foundation on 2025-07-11. There is no vendor-provided patch or official remediation information available at this time.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected system, leading to full remote code execution. This can result in complete compromise of the system running Synway SMG Gateway Management Software. The vulnerability has a critical CVSS score of 9.3, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious POST requests targeting the RADIUS configuration endpoint. Avoid exposing the management interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.