CVE-2025-56498

An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.

• CWE-78

• https://github.com/Jorge2Rubio/CVEs/blob/main/CVE-2025-56498.mdExploit, Third Party Advisory
• https://prolink2u.com/products/pgn6401vProduct

Published

Sep 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56463Mercusys MW305R 3.30 and below is has a Transport Layer Secu…6.8
• CVE-2025-56466Hardcoded credentials in Dietly v1.25.0 for android allows a…7.5
• CVE-2025-56467An issue was discovered in AXIS BANK LIMITED Axis Mobile App…6.5
• CVE-2025-5647A vulnerability was found in Radare2 5.9.9 and classified as…2.5
• CVE-2025-5648A vulnerability was found in Radare2 5.9.9. It has been clas…2.5
• CVE-2025-5649A vulnerability classified as critical has been found in Sou…6.5
• CVE-2025-56499Incorrect access control in mihomo v1.19.11 allows authentic…6.5
• CVE-2025-5650A vulnerability classified as critical was found in 1000proj…9.8
• CVE-2025-56503An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows au…6.5
• CVE-2025-5651A vulnerability, which was classified as problematic, has be…5.4
• CVE-2025-56513NiceHash QuickMiner 6.12.0 perform software updates over HTT…9.8
• CVE-2025-56514Cross Site Scripting (XSS) vulnerability in Fiora chat appli…5.4