RCE in Prolink2u Pgn6401v
CVE-2025-56498
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.017 (75.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Prolink2u Pgn6401v
- Prolink2u Pgn6401v_firmware
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-56498?
- CVE-2025-56498 is a medium-severity vulnerability in Prolink2u Pgn6401v, classified under OS Command Injection. CVSS score: 5.3/10. Published 2025-09-03.
- How severe is CVE-2025-56498?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-56498 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.