WODESYS WD-R608U CVE-2025-65008
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold (LAN/Wi-Fi)
-
DeliverySend crafted request to adm.cgi
-
ExploitInject shell metacharacters via langGet
-
ExecutionExecute arbitrary commands as router process
-
ImpactFull device compromise and network pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the router's adm.cgi web management interface and be on an adjacent network (CVSS AV:A - same LAN or Wi-Fi segment), not the broader internet, unless the admin interface is deliberately exposed. No authentication is needed (PR:N) and no user interaction (UI:N); the attacker simply injects shell metacharacters into the langGet parameter, which is passed to a system shell without validation. Limiting factors: adjacent-network positioning, exposure of the adm.cgi endpoint, and use of affected firmware - only WDR28081123OV1.01 is confirmed vulnerable, though the vendor-unconfirmed version range means others may qualify. |
| Impact | This is an OS command injection (CWE-78) in the adm.cgi endpoint of the WODESYS WD-R608U SOHO router, exploitable via the unvalidated langGet parameter. The critical nuance overlooked by the raw 9.4 score is the attack vector: the CVSS 4.0 vector specifies AV:A (Adjacent), NOT AV:N (Network), meaning the attacker must be on the same LAN/Wi-Fi broadcast segment as the router - not exploitable across the open internet unless the management interface is exposed. Within that constraint the flaw is severe: PR:N (unauthenticated) and AC:L give a low-effort path to full device compromise (VC:H/VI:H/VA:H). EPSS is 2.70% (85th percentile), notably elevated for a niche embedded product and consistent with a public, low-complexity injection primitive, but it reflects prediction, not observed activity. There is NO CISA KEV listing and no structured POC=YES signal, so this is not confirmed in-the-wild exploitation - the elevated EPSS suggests a plausible but not yet weaponized/widespread target. Net: a genuinely high-impact bug that is real priority for anyone operating this hardware, but the adjacent-only vector and obscure, low-footprint vendor materially cap real-world blast radius compared to a network-facing router RCE. |
| Exploit ScenarioDerived | An attacker who has gained access to the local network (e.g., an open/guest Wi-Fi, a compromised LAN host, or a rogue device) sends a crafted request to the adm.cgi endpoint with shell metacharacters in the langGet parameter, causing the router to execute arbitrary system commands without authentication. This yields full control of the router for traffic interception, pivoting, or persistence. No confirmed public exploit code is identified, though the researcher's GitHub repository (github.com/wcyb/security_research) may contain technical details or proof-of-concept. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.
RemediationAI
No vendor-released patch has been identified at the time of analysis: WODESYS was contacted but did not respond with remediation details or a fixed version, so firmware WDR28081123OV1.01 and any untested builds must be treated as unfixed. Until a vendor update appears, apply compensating controls that directly break the attack path. First, ensure the adm.cgi management interface is never reachable from the WAN or from untrusted network segments - disable any remote/cloud management, UPnP port-forwarding, and DMZ settings that publish port 80/443 on the router, and verify from an external host that the admin UI is not exposed (trade-off: loses convenient remote administration, which must then be performed over VPN). Second, isolate the router's management plane by placing it on a dedicated management VLAN or, in a flat home network, restrict access with host firewalls so only known administrative clients can reach the router's web UI; the CVSS AV:A (adjacent network) vector means attackers on the same LAN, guest Wi-Fi, or a compromised IoT device can still exploit it, so segmenting IoT/guest traffic away from the router management subnet is material. Third, treat Wi-Fi/guest credentials as security-relevant, since obtaining LAN adjacency is the main barrier to exploitation; rotate the router's admin password and Wi-Fi keys and disable WPS. Fourth, monitor router traffic for anomalous outbound connections or unexpected shell activity, and consider replacing or retiring the device if the vendor remains unresponsive, since no fix timeline exists. Track the CERT Polska advisory at https://cert.pl/en/posts/2025/12/CVE-2025-65007 and the referenced research at https://github.com/wcyb/security_research for updated version and patch information.
Affected ProductsAI
The primary affected device is the WODESYS WD-R608U router, which is also marketed under the names WDR122B V2.0 and WDR28 (vendor product page: http://www.wodesys.com/eproductms52.html). Only firmware build WDR28081123OV1.01 was tested and confirmed vulnerable by the reporter (cvd@cert.pl); the vendor was notified early but did not provide a vulnerability statement or an affected version range, so other firmware builds and possibly related WODESYS models sharing the same adm.cgi codebase may also be vulnerable but remain untested. No CPE strings were included in the provided intelligence. The reporting advisory is available from CERT Polska at https://cert.pl/en/posts/2025/12/CVE-2025-65007, and supporting research is referenced at https://github.com/wcyb/security_research.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the classic command-injection class affecting embedded device CGI handlers. The affected firmware exposes a web-based configuration interface whose CGI binary adm.cgi handles the langGet parameter, presumably used to select the interface language. That value is concatenated into a shell command - typically via a C system()/popen() call on the device's BusyBox/Linux userland - without sanitization or allow-listing, so shell metacharacters (;, |, $(), backticks, &&) let an attacker append arbitrary commands. On embedded SOHO routers the HTTP daemon usually runs as root, so injected commands generally execute with full device privileges, giving complete control over configuration, credentials, routing, firewall rules, and potentially the ability to pivot into the local network. The CVSS:4.0 vector scores 9.4 with AV:A (adjacent network), PR:N, UI:N and high impact (VC/VI/VA:H plus subsequent-system SC/SI/SA:H); the independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity, and availability impact from an unauthenticated adjacent attacker. No CPE identifiers were supplied in the source data, and the affected platform string is the firmware build WDR28081123OV1.01.
Know when Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Adjacent web interface (AV:A) with trivial unauthenticated injection (AC:L/PR:N/UI:N) yields full command execution on the router itself, so C/I/A:H and S:U as the vulnerable component is the impacted one.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Executive ViewAI
WODESYS WD-R608U, WDR122B V2.0, and WDR28 small-office/home-office routers are affected by a critical command-injection flaw in their web management interface that can let an attacker on the same local network or Wi-Fi execute system-level commands on the device. With no vendor patch currently available, these routers represent a containment and continuity risk for branch offices, remote workers, and any environment where management access is reachable from less-trusted segments. Security leadership should prioritize inventory, isolation, and monitoring of these devices until the vendor provides a fix or they are replaced; no public exploit code had been identified at the time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected routers on dedicated VLANs or guest Wi-Fi, disabling WAN/remote management, restricting adm.cgi access to trusted management networks, blocking the langGet parameter at controlling firewalls or WLAN controllers, disabling Wi-Fi administration, enforcing strong WPA3/PSK with client isolation, monitoring logs and IDS for adm.cgi/langGet exploitation attempts, and planning replacement or continued strict segmentation until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Exploit-DB