CVE-2025-10324 in WL-WN578W2
Summary
by MITRE • 09/12/2025
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2025
The vulnerability identified as CVE-2025-10324 resides within the Wavlink WL-WN578W2 221110 wireless router firmware, specifically targeting the firewall.cgi component. This device operates as a network gateway and security appliance, managing firewall rules and network access controls for connected devices. The affected function sub_401C5C processes user-supplied parameters related to firewall configuration settings including pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled, and remoteManagementEnabled. These parameters control critical security features that regulate network traffic filtering and remote management access. The vulnerability stems from inadequate input validation and sanitization within the web interface, creating a path for malicious actors to inject arbitrary commands into the system through carefully crafted HTTP requests.
This represents a critical command injection vulnerability classified under CWE-77, which occurs when a web application incorporates user-controllable data into system commands without proper validation or escaping. The flaw allows remote attackers to execute arbitrary code on the affected device by manipulating the aforementioned boolean parameters in the firewall.cgi script. When these parameters are processed, the system fails to properly escape or validate their contents, enabling attackers to inject shell commands that execute with the privileges of the web server process. The vulnerability is particularly concerning because it affects core firewall functionality, potentially allowing attackers to bypass network security controls, disable protective measures, or gain full administrative access to the device. The attack vector is entirely remote, requiring no physical access or authentication credentials, making it highly exploitable in network environments where these devices are accessible from external networks.
The operational impact of this vulnerability extends beyond simple command execution, as it fundamentally compromises the security posture of any network relying on this device. An attacker could disable essential security features such as WAN filtering, SYN flood protection, port scanning prevention, or remote management access, effectively weakening the device's protective capabilities. Additionally, the vulnerability could enable complete device takeover, allowing attackers to modify firewall rules, redirect traffic, or establish persistent backdoors. The lack of vendor response despite early disclosure indicates a potential security gap in the device's support lifecycle, leaving users without official patches or mitigation guidance. This vulnerability directly aligns with ATT&CK technique T1059.001 for command and scripting interpreter, specifically shell script execution, and represents a significant risk to network infrastructure security. The public disclosure of exploit code increases the likelihood of widespread exploitation, particularly in environments where these devices are deployed without proper network segmentation or monitoring.
Mitigation strategies should prioritize immediate network segmentation and access control measures to limit exposure of affected devices to untrusted networks. Network administrators should disable unnecessary services and remote management capabilities on the device until a patch is available. The implementation of network monitoring and intrusion detection systems can help detect suspicious command execution patterns or unusual traffic flows. Regular firmware updates should be prioritized, and vendors should be contacted to request security patches or advisories for affected devices. For environments where patching is not immediately possible, implementing strict firewall rules to limit access to the device's web interface and disabling unused features can provide temporary protection. Security teams should also consider conducting network scans to identify all instances of this device model and assess their exposure levels. The vulnerability underscores the importance of secure coding practices and input validation in network security appliances, as well as the critical need for timely vendor response to security disclosures. Organizations should also review their device lifecycle management policies to ensure that legacy or unsupported hardware is properly retired from production environments.