CVE-2025-4999

A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153FC of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of the argument supplicant_rnd_id_en leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-74
• CWE-77
• CWE-77

• https://github.com/CH13hh/tmp_store_cc/blob/main/FGW3000/1.mdBroken Link
• https://vuldb.com/?ctiid.309650Permissions Required, VDB Entry
• https://vuldb.com/?id.309650Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.565909Third Party Advisory, VDB Entry
• https://www.linksys.com/Product

Published

May 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49984Server-Side Request Forgery (SSRF) vulnerability in blubrry …4.9
• CVE-2025-49985Server-Side Request Forgery (SSRF) vulnerability in Ali Iran…4.9
• CVE-2025-49986Missing Authorization vulnerability in thanhtungtnt Video Li…5.3
• CVE-2025-49987Missing Authorization vulnerability in WPFactory CRM ERP Bus…5.3
• CVE-2025-49988Missing Authorization vulnerability in Renzo Johnson Contact…5.3
• CVE-2025-49989Missing Authorization vulnerability in App Cheap App Builder…5.3
• CVE-2025-49990Missing Authorization vulnerability in contentstudio Content…5.3
• CVE-2025-49991Missing Authorization vulnerability in tggfref WP-Recall all…5.3
• CVE-2025-49992Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-49993Missing Authorization vulnerability in csarturas Cookie-Scri…5.3
• CVE-2025-49994Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-49995Authorization Bypass Through User-Controlled Key vulnerabili…5.3