Mercusys MW301R 1.0.2 Build 190726 Rel.59423n Login excessive authentication

Summaryinfo

A vulnerability identified as problematic has been detected in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. Affected is an unknown function of the component Login. The manipulation leads to excessive authentication. This vulnerability is uniquely identified as CVE-2025-7882. The attack can only be initiated within the local network. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown functionality of the component Login. The manipulation with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is integrity.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-7882. The exploitation is known to be difficult. The attack can only be initiated within the local network. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

The exploit is available at github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-22004). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Mercusys

Name

• MW301R

Version

• 1.0.2 Build 190726 Rel.59423n

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #611431: Mercusys Router MW301R 1.0.2 Build 190726 Rel.59423n (4252) 7PK Security Features / Brute Force via IP Cycling (by RaulPACXXX)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion