WODESYS WD-R608U/WDR28/WDR122B Configuration Change adm.cgi missing authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in WODESYS WD-R608U, WDR28 and WDR122B. Impacted is an unknown function of the file adm.cgi of the component Configuration Change Module. Executing a manipulation can lead to missing authentication. This vulnerability appears as CVE-2025-65007. The attacker needs to be present on the local network. There is no available exploit.

Detailsinfo

A vulnerability was found in WODESYS WD-R608U, WDR28 and WDR122B (affected version unknown). It has been declared as critical. This vulnerability affects an unknown functionality of the file adm.cgi of the component Configuration Change Module. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the unauthenticated attacker can execute commands including backup creation, device restart and resetting the device to factory settings. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The weakness was presented by Wojciech Cybowski. This vulnerability was named CVE-2025-65007 since 11/13/2025. The exploitation appears to be easy. The attack can only be done within the local network. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/18/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• WODESYS

Name

• WD-R608U
• WDR28
• WDR122B

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion