PT-2025-37395 · Unknown · Mercury Km08-708H Giga Wifi Wave2

Jason J · Published 2025-09-14 · Updated 2025-09-18 · CVE-2025-10385

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mercury KM08-708H GiGA WiFi Wave2 version 1.1

Description A buffer overflow issue exists in the sub 450B2C function of the /goform/mcr setSysAdm file. The vulnerability is triggered by manipulating the ChgUserId argument, allowing for remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations As a temporary workaround, consider restricting access to the /goform/mcr setSysAdm file to minimize the risk of exploitation. Avoid using the ChgUserId parameter in the affected function sub 450B2C until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2025-10385

Affected Products

Mercury Km08-708H Giga Wifi Wave2

References · 11

• 🔥 https://github.com/Jjx-wy/kt/blob/main/KT%20KM08-708H.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10385 · Security Note
• https://twitter.com/CveFindCom/status/1967032832225595670 · Twitter Post
• https://vuldb.com/?ctiid.323820 · Note
• https://vuldb.com/?submit.643902 · Note
• https://vuldb.com/?id.323820 · Note
• https://twitter.com/VulmonFeeds/status/1967041302417100913 · Twitter Post
• https://twitter.com/CVEnew/status/1967056443116310622 · Twitter Post
• https://t.me/CVEtracker/32434 · Telegram Post
• https://t.me/cveNotify/135386 · Telegram Post
• https://twitter.com/cracbot/status/1968631138236383699 · Twitter Post