RCE in Prolink2u Pgn6401v
CVE-2025-56498
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.017 (76.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- prolink2u.com/products/pgn6401v (Product)
- github.com/Jorge2Rubio/CVEs/blob/main/CVE-2025-56498.md (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-56498?
- CVE-2025-56498 is a medium-severity vulnerability in Prolink2u Pgn6401v, classified under OS Command Injection. CVSS score: 5.3/10. Published 2025-09-03.
- How severe is CVE-2025-56498?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-56498 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.