The vulnerability is an OS command injection flaw in the RADIUS configuration endpoint of Synway SMG Gateway Management Software. An unauthenticated remote attacker can craft a POST request that injects arbitrary shell commands via the radius_address, radius_address2, shared_secret2, source_ip, timeout, or retry parameters. The injection exploits unsanitized input that is directly interpolated into a sed command, allowing the attacker to execute commands on the host with the privileges of the web service. This results in full remote code execution, potentially leading to complete system compromise, data exfiltration, or denial of service.

The affected product is Synway SMG Gateway Management Software from Synway Information Engineering Co., Ltd. The vulnerability is present in the RADIUS configuration interface (e.g., /en/9-2radius.php) and applies to version 9.2. No information is available about earlier releases, so only confirmed builds are at risk until an official update is released.

The CVSS score of 9.3 categorises this flaw as critical. The EPSS score is not available, but the exploitation was observed by the Shadowserver Foundation on 2025-07-11, indicating real-world activity. The vulnerability is not yet listed in CISA KEV. The attack vector is unauthenticated remote: an attacker only needs network access to submit a crafted POST request to the RADIUS configuration endpoint. Because the flaw allows arbitrary shell execution, the impact is severe and could compromise the entire gateway device. The lack of an exploit database entry suggests the vulnerability is not widely automated yet, but the exploitation evidence indicates that attackers are actively leveraging it.