EUVD-2025-21351Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
AnalysisAI
CVE-2025-50756 is a critical unauthenticated command injection vulnerability in the Wavlink WN535K3 router (firmware version 20191010) affecting the set_sys_adm function's newpass parameter. An unauthenticated remote attacker can execute arbitrary system commands with root privileges by sending a crafted request, enabling complete device compromise including data theft, malware installation, and lateral network movement. The CVSS 9.8 score reflects maximum severity; KEV status and active exploitation likelihood are elevated given the high exploitability characteristics (network-accessible, no authentication required, low attack complexity).
Technical ContextAI
The vulnerability stems from improper input validation and sanitization in the set_sys_adm administrative function, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The Wavlink WN535K3 is a consumer-grade WiFi router running embedded Linux firmware. The newpass parameter, intended for password updates, fails to properly escape or filter shell metacharacters and command separators (e.g., semicolons, pipes, command substitution operators), allowing OS command injection. The firmware version 20191010 indicates this is legacy hardware; affected CPE would be: cpe:2.3:o:wavlink:wn535k3_firmware:20191010:*:*:*:*:*:*:*. The vulnerability likely exists in the HTTP/HTTPS web interface or UPnP service that handles administrative requests, common attack surfaces for router exploitation.
RemediationAI
Immediate Actions: (1) Check Wavlink's official firmware repository and security advisory page for patched firmware versions newer than 20191010—download and apply via the device's web interface (System Settings > Firmware Update) or via TFTP if web interface is compromised; (2) If no patch is available, implement network-level mitigations: restrict HTTP/HTTPS access to the router's management interface via firewall rules (limit to trusted administrative subnets only), disable remote management features in router settings, and segment the router's management network from general user traffic; (3) Change default credentials immediately if not already done; (4) Isolate affected devices to air-gapped or highly restricted networks if patching is unavailable; (5) Long-term: replace end-of-life hardware with modern routers receiving active firmware updates (Wavlink models post-2020+ with active vendor support). Contact Wavlink technical support at support.wavlink.com or sales@wavlink.com for patch availability confirmation and extended support options.
Share
External POC / Exploit Code
Leaving vuln.today