PT-2025-35571 · Wavlink · Wavlink Wn535G3

Summermu · Published 2025-09-02 · Updated 2025-09-03 · CVE-2025-50757

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wavlink WN535K3 version 20191010

Description A command injection vulnerability exists in the set sys adm function of the Wavlink WN535K3 router. The vulnerability is triggered through manipulation of the username parameter, allowing attackers to execute arbitrary commands via a crafted request.

Recommendations As a temporary workaround, restrict access to the set sys adm function until a patch is available. Avoid using the username parameter in requests to the affected function until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-50757

Affected Products

Wavlink Wn535G3

References · 6

• 🔥 https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WN535K3/set_sys_adm_username/readme.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-50757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50757 · Security Note
• https://twitter.com/VulmonFeeds/status/1962906166637240803 · Twitter Post
• https://twitter.com/CVEnew/status/1962897386616782907 · Twitter Post
• https://twitter.com/ET_Labs/status/1963338797573181539 · Twitter Post