PT-2025-23435 · Wavlink · Wl-Wn530Hg3+5

Ch13Hh

·

Published

2025-06-01

·

Updated

2025-06-05

·

CVE-2025-5408

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3, and WL-WN576K1 versions up to V1410 240222
Description A critical issue was found in the affected devices, classified as critical. The problem lies in the function sys login of the file /cgi-bin/login.cgi of the component HTTP POST Request Handler. The manipulation of the argument login page leads to buffer overflow. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Recommendations For WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3, and WL-WN576K1 versions up to V1410 240222, consider disabling the sys login function in the /cgi-bin/login.cgi file as a temporary workaround until a patch is available. Restrict access to the /cgi-bin/login.cgi file to minimize the risk of exploitation. Avoid using the login page argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-06255
CVE-2025-5408

Affected Products

Wavlink Quantum D2G
Wavlink Quantum D3G
Wl-Wn530G3A
Wl-Wn530Hg3
Wl-Wn532A3
Wl-Wn576K1