PT-2025-18789 · Wavlink · Wavlink Wl-Wn530Hg4

Summermu · Published 2025-04-11 · Updated 2025-06-13 · CVE-2025-44868

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530H4 version 20220801

Description The issue is related to a command injection vulnerability in the ping test function of the adm.cgi via the pingIp parameter. This allows attackers to execute arbitrary commands via a crafted request to the API endpoint /adm.cgi.

Recommendations For Wavlink WL-WN530H4 version 20220801, as a temporary workaround, consider disabling the ping test function until a patch is available. Restrict access to the adm.cgi module to minimize the risk of exploitation. Avoid using the pingIp parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-07420

CVE-2025-44868

Affected Products

Wavlink Wl-Wn530Hg4

References · 8

• 🔥 https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WL-WN530H4/ping_test/readme.md · Exploit
• 🔥 https://github.com/Summermu/VulnForIoT/blob/main/Wavlink_WL-WN530H4/ping_test/readme.md · Exploit
• https://bdu.fstec.ru/vul/2025-07420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-44868 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44868 · Vendor Advisory
• https://twitter.com/cybercronai/status/1918672000899264703 · Twitter Post
• https://twitter.com/dailycve/status/1933540135540339017 · Twitter Post
• https://twitter.com/CVEnew/status/1918568497896149389 · Twitter Post