PT-2025-52248 · Wodesys · Wdr122B V2.0+2

Wojciech Cybowski · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-65009

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WODESYS WD-R608U router versions prior to WDR28081123OV1.01 WODESYS WDR122B V2.0 (affected versions not specified) WODESYS WDR28 (affected versions not specified)

Description The admin password for WODESYS routers is stored in a configuration file as plaintext. This allows an unauthorized user to obtain the password through direct access to the resource. The vendor was notified of this issue but did not provide details about vulnerable versions or a response. Only version WDR28081123OV1.01 was confirmed as vulnerable, and other versions may also be affected.

Recommendations Update to version WDR28081123OV1.01 or later. For WODESYS WDR122B V2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WODESYS WDR28, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-256

Related Identifiers

CVE-2025-65009

Affected Products

Wd-R608U Router

Wdr122B V2.0

Wdr28

References · 5

• 🔥 https://github.com/wcyb/security_research · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65009 · Security Note
• https://twitter.com/CVEnew/status/2001728034534207765 · Twitter Post
• https://cert.pl/en/posts/2025/12/CVE-2025-65007 · Note
• http://wodesys.com/eproductms52.html · Note