PT-2025-52249 · Wodesys · Wdr122B V2.0+2

Wojciech Cybowski · CVE-2025-65010 · Published 2025-12-18 · Updated 2025-12-18

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WODESYS WD-R608U router versions prior to WDR28081123OV1.01 WODESYS WDR122B V2.0 (affected versions not specified) WODESYS WDR28 (affected versions not specified)

Description The WODESYS WD-R608U router, also known as WDR122B V2.0 and WDR28, exhibits a Broken Access Control issue within the initial configuration wizard.cgi endpoint. An attacker can modify the administrator panel password without authorization. This issue persists even after the initial configuration is completed. The vendor was notified but did not provide details regarding vulnerable version ranges.

Recommendations Update to version WDR28081123OV1.01 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-65010

Affected Products

Wd-R608U

Wdr122B V2.0

Wdr28

References · 5

• 🔥 https://github.com/wcyb/security_research · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65010 · Security Note
• https://cert.pl/posts/2025/12/CVE-2025-65007 · Note
• http://wodesys.com/eproductms52.html · Note
• https://twitter.com/CVEnew/status/2001728032990793883 · Twitter Post