CVE-2025-10325 in WL-WN578W2
Summary
by MITRE • 09/12/2025
A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2025
This vulnerability exists within the Wavlink WL-WN578W2 221110 wireless router firmware where a command injection flaw has been identified in the login.cgi script. The specific function sub_401340/sub_401BA4 within the /cgi-bin/login.cgi file demonstrates improper input validation when processing the ipaddr argument parameter. This represents a critical security weakness that allows remote attackers to execute arbitrary commands on the affected device through manipulation of the ipaddr parameter. The vulnerability stems from inadequate sanitization of user-supplied input data, creating an environment where attacker-controlled commands can be interpreted and executed by the underlying system shell. The attack vector is particularly concerning as it enables remote exploitation without requiring authentication, making it accessible to any network user who can reach the device's web interface.
The technical implementation of this vulnerability follows the classic command injection pattern where user input flows directly into system execution contexts without proper validation or encoding. When an attacker submits malicious input through the ipaddr parameter, the application fails to properly escape or filter special characters that could alter the intended command execution flow. This allows for arbitrary command execution with the privileges of the web server process, typically running with elevated permissions on the device. The presence of a publicly available exploit significantly increases the risk profile as it eliminates the need for advanced exploitation techniques and reduces the barrier to successful compromise. The vulnerability directly maps to CWE-77 and CWE-88 within the Common Weakness Enumeration framework, specifically addressing improper neutralization of special elements used in command execution contexts.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete device compromise and potential network infiltration. An attacker who successfully exploits this vulnerability could gain full administrative control over the router, enabling them to modify network configurations, redirect traffic, establish persistent backdoors, or use the device as a pivot point for attacking other systems within the local network. The compromised device could serve as a command and control node for larger attack campaigns or be used to perform man-in-the-middle attacks on network traffic. Given that many users may not regularly update their router firmware, the window of exposure for this vulnerability remains significant, particularly in environments where network devices are managed by non-technical personnel or in home networks where security updates are often neglected. This vulnerability also aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1566.001 for spearphishing attachment, as it provides a mechanism for executing malicious commands and potentially delivering additional payloads.
The lack of vendor response to early disclosure attempts represents a critical failure in the security ecosystem, leaving affected users without official patches or mitigation guidance. This absence of vendor support creates an urgent need for immediate remediation actions from users and network administrators who may be affected by this vulnerability. The most effective immediate mitigation involves disabling remote administrative access to the device when possible, implementing network segmentation to isolate the affected router, and applying any available firmware updates from the manufacturer. However, given the vendor's lack of response, users should consider replacing the device with a more secure alternative or implementing additional network security controls such as firewalls and intrusion detection systems to monitor for exploitation attempts. Organizations should also conduct comprehensive network assessments to identify all instances of this vulnerable device and implement monitoring solutions to detect potential exploitation attempts. The vulnerability demonstrates the importance of vendor security response protocols and highlights the risks associated with legacy devices that may no longer receive security updates or support from manufacturers.