Full Report
CERT Polska has received a report about 5 vulnerabilities (from CVE-2025-65007 to CVE-2025-65011) found in WODESYS WD-R608U router.
Analysis Summary
This summary covers five vulnerabilities reported in the WODESYS WD-R608U router. Specific CVSS scores and exploitation status were not provided in the source material; consequently, these fields are marked as "Not Available" or derived based on the technical description.
---
# Vulnerability: Multiple Flaws in WODESYS WD-R608U Router (CVE-2025-65007 through CVE-2025-65011)
## CVE Details
This report covers five distinct CVEs. Since official severity scores were not provided, they are noted as such.
| CVE ID | Severity (Assumed/Not Provided) | CWE |
| :--- | :--- | :--- |
| CVE-2025-65007 | Not Available | CWE-306 (Missing Authentication for Critical Function) |
| CVE-2025-65008 | Not Available | CWE-78 (OS Command Injection) |
| CVE-2025-65009 | Not Available | CWE-256 (Plaintext Storage of a Password) |
| CVE-2025-65010 | Not Available | CWE-306 (Missing Authentication for Critical Function) |
| CVE-2025-65011 | Not Available | CWE-425 (Direct Request / Forced Browsing) |
## Affected Systems
- **Products:** WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28).
- **Versions:** WDR28081123OV1.01 (Confirmed vulnerable; other versions might be vulnerable).
- **Configurations:** Applicable to devices both during and after initial configuration setup.
## Vulnerability Description
Five vulnerabilities were reported, allowing an unauthenticated attacker to gain significant control over the device:
1. **CVE-2025-65007 (Missing Authentication):** Lack of authentication checks in the `adm.cgi` endpoint allows unauthenticated attackers to execute configuration commands, including creating backups, restarting the device, and factory resetting the device.
2. **CVE-2025-65008 (OS Command Injection):** Lack of adequate validation for the `langGet` parameter in `adm.cgi` allows an attacker to inject and execute arbitrary system shell commands.
3. **CVE-2025-65009 (Plaintext Password Storage):** The administrative password is saved in plaintext within the configuration file, allowing unauthorized users to retrieve it via direct access to the configuration resource.
4. **CVE-2025-65010 (Broken Access Control/Authentication Bypass):** A vulnerability in the initial setup endpoint (`wizard.cgi`) allows an attacker to change the administrator password without authorization, even after the initial setup is complete.
5. **CVE-2025-65011 (Forced Browsing/Direct Request):** An unauthenticated user can directly access and view configuration files by referencing the resource path directly.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild, but PoC capability is implied by the technical details provided (e.g., command injection, configuration modification).
- **Complexity:** Likely **Low** for execution of the authentication weaknesses (CVE-2025-65007, -65010, -65011) and command injection (CVE-2025-65008).
- **Attack Vector:** Primarily **Network** (remote exploitation over the device management interface).
## Impact
Based on the technical descriptions of remote command execution and password exposure:
- **Confidentiality:** **High** (Ability to read configuration files, including plaintext passwords).
- **Integrity:** **High** (Ability to execute arbitrary commands, change passwords, and modify configuration).
- **Availability:** **High** (Ability to cause denial of service via device restart or factory reset).
## Remediation
### Patches
- **Status:** Vendor (WODESYS) did not respond with details regarding patches or vulnerable version ranges for coordinated disclosure. Consequently, **No official patch information is available** at this time, even though version WDR28081123OV1.01 is confirmed vulnerable.
### Workarounds
- Isolate the device from untrusted networks.
- Restrict administrative HTTP/HTTPS access only to trusted IP addresses via firewall rules (if possible).
- **Immediate action required:** Change the default administrative password immediately, though this may be circumvented by CVE-2025-65010.
## Detection
- **Indicators of Compromise:** Unexpected restarts, configuration changes (e.g., modification of backup files, unauthorized user/password changes), or unusual outbound network traffic originating from the router management interface.
- **Detection Methods and Tools:** Network monitoring tools should check for unauthenticated requests accessing `/adm.cgi` or `/wizard.cgi`. File integrity monitoring on the system partition (if accessible) might reveal altered configuration files.
## References
- Vendor Advisories: **None provided** by WODESYS during coordination.
- Relevant links:
- CERT Polska Disclosure Page: hXXps://cert.pl/en/cvd/