---
id: CVE-2015-10145
title: >-
  Gargoyle router management utility versions 1.5.x contain an authenticated OS
  command execution vulnerability in /utility/run_commands.sh
summary: >-
  Gargoyle router management utility versions 1.5.x contain an authenticated OS
  command execution vulnerability in /utility/run_commands.sh. The application
  fails to properly restrict or validate input supplied via the 'commands'
  parameter…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: gargoyle-router
product: gargoyle
affected:
  - 'gargoyle >= 1.5.0, <= 1.5.11'
published: '2025-12-31'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T14:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2015-10145'
references:
  - url: 'https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/'
    label: disclosure@vulncheck.com
  - url: 'https://packetstorm.news/files/id/132149'
    label: disclosure@vulncheck.com
  - url: 'https://www.gargoyle-router.com/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gargoyle-authenticated-os-command-execution-via-run-commands-sh
    label: disclosure@vulncheck.com
  - url: 'https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00717
epssPercentile: 0.52361
ingestedAt: '2026-09-23T14:25:29.783Z'
---

## Overview

Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/run_commands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary shell commands on the underlying system. Successful exploitation may result in full compromise of the device, including unauthorized access to system files and execution of attacker-controlled commands.

## Affected

- `gargoyle >= 1.5.0, <= 1.5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.