PT-2025-37344 · Wavlink · Wavlink Wl-Wn578W2

N0Ps1Ed · Published 2025-08-28 · Updated 2025-09-17 · CVE-2025-10324

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN578W2 version 221110

Description: A vulnerability exists in the Wavlink WL-WN578W2 router. Manipulation of the arguments pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled, or remoteManagementEnabled within the firewall.cgi file and the sub 401C5C function can lead to command injection. This manipulation is possible remotely. The exploit has been publicly disclosed.

Recommendations: As a temporary workaround, consider restricting access to the firewall.cgi file to minimize the risk of exploitation. Disable the pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled, and remoteManagementEnabled arguments.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2025-11319

CVE-2025-10324

Affected Products

Wavlink Wl-Wn578W2

References · 12

• 🔥 https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/firewall.cgi/websSysFirewall · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10324 · Security Note
• https://bdu.fstec.ru/vul/2025-11319 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10324 · Vendor Advisory
• https://vuldb.com/?submit.643435 · Note
• https://vuldb.com/?id.323750 · Note
• https://twitter.com/VulmonFeeds/status/1966616057889612278 · Twitter Post
• https://t.me/CVEtracker/32406 · Telegram Post
• https://twitter.com/SecAideInfo/status/1967532755371098595 · Twitter Post
• https://twitter.com/cracbot/status/1968268785112223890 · Twitter Post
• https://vuldb.com/?ctiid.323750 · Note
• https://twitter.com/CVEnew/status/1966590269886705672 · Twitter Post