High · published January 1, 2026
⚡ An authenticated user can execute arbitrary shell commands on your Gargoyle router! Yes, you read that right! 🚨 Think of it like a hotel concierge who forgets to check guest requests before acting on them — they could end up letting an unauthorized person access any room just by asking nicely! This could lead to an attacker taking full control of the router, potentially accessing sensitive system files and executing any commands they choose. The ramifications could be absolutely devastating, allowing them to manipulate your network and devices at will!
Think of it like a hotel concierge who forgets to check guest requests before acting on them — they could end up letting an unauthorized person access any room just by asking nicely! The vulnerability arises from insufficient input validation in the '/utility/run_commands.sh' script, allowing an authenticated attacker to pass arbitrary commands through the 'commands' parameter.
This could lead to an attacker taking full control of the router, potentially accessing sensitive system files and executing any commands they choose. The ramifications could be absolutely devastating, allowing them to manipulate your network and devices at will! Upgrade your Gargoyle router to version 1.5.11 or later to close this security hole. Additionally, review user access levels and ensure only trusted users can authenticate to the router interface. You've got this! By following these steps, you'll secure your system in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gargoyle-router/gargoyle | ≥ 1.5.0, ≤ 1.5.11 | — |