WODESYS routers exposed by five critical flaws
Five vulnerabilities in WODESYS WD-R608U routers enable unauthenticated attackers to execute commands, change passwords, and access plaintext credentials.
Sourcecert.pl — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has disclosed five vulnerabilities affecting WODESYS WD-R608U routers (also sold as WDR122B V2.0 and WDR28). The flaws collectively allow unauthenticated remote attackers to fully compromise affected devices through multiple attack vectors. CVE-2025-65007 permits unauthenticated configuration changes including backup creation and factory resets via the adm.cgi endpoint. CVE-2025-65008 enables command injection through insufficient validation of the langGet parameter. CVE-2025-65009 exposes admin passwords stored in plaintext within configuration files accessible to unauthorized users.
Two additional access control vulnerabilities compound the exposure. CVE-2025-65010 affects the initial configuration wizard.cgi endpoint, allowing attackers to change the admin password without authorization even after initial setup is complete. CVE-2025-65011 permits unauthorized viewing of configuration files through direct resource references. The vendor was notified but did not respond with details or a vulnerability scope. Only firmware version WDR28081123OV1.01 was confirmed vulnerable during testing; other versions remain untested and potentially affected.
The vulnerability chain effectively grants complete device control to unauthenticated attackers, who can extract credentials, modify configurations, execute arbitrary commands, and maintain persistent access. Organizations using these routers should assume compromise and implement compensating controls including network segmentation and replacement with patched or alternative hardware.
Mentioned in this report
Detection guidance
WODESYS Router Unauthenticated adm.cgi Configuration Change
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to the adm.cgi endpoint on WODESYS WD-R608U/WDR122B/WDR28 routers requesting backup, restore, or factory-reset actions, indicative of CVE-2025-65007 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Unauthenticated adm.cgi Configuration Change
id: 3e4220ec-cf1c-565a-9e48-327f4bca3406
status: experimental
description: Detects HTTP requests to the adm.cgi endpoint on WODESYS routers invoking
backup, restore, or reset actions without prior authentication, consistent with
CVE-2025-65007.
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: adm.cgi
cs-uri-query|contains:
- backup
- restore
- reset
- factory
filter_auth:
cs-uri-query|contains: session=
condition: selection and not filter_auth
falsepositives:
- Legitimate administrative backup or factory-reset operations performed by an authenticated
network administrator using a valid session token
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
WODESYS Router Command Injection via langGet Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing shell metacharacters in the langGet parameter of WODESYS router CGI endpoints, indicative of command injection exploitation (CVE-2025-65008). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Command Injection via langGet Parameter
id: 6c547f17-945e-5f94-857b-969a61f96b35
status: experimental
description: Detects requests where the langGet CGI parameter contains shell metacharacters
or command chaining sequences, consistent with unauthenticated command injection
on WODESYS routers (CVE-2025-65008).
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: langGet=
injection_chars:
cs-uri-query|contains:
- ;
- '|'
- '&&'
- '`'
- $(
- '%0a'
- '%3b'
condition: selection and injection_chars
falsepositives:
- Automated vulnerability scanners or penetration testing tools deliberately probing
the langGet parameter
falsepositives_note: none
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
WODESYS Router Plaintext Configuration File Access Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated requests to configuration file resources on WODESYS routers that may expose plaintext admin credentials, consistent with CVE-2025-65009 and CVE-2025-65011. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Plaintext Configuration File Access Attempt
id: f5fd5a9c-2d67-5cbd-bd04-bf630a93ac61
status: experimental
description: Detects direct HTTP requests to WODESYS router configuration file endpoints
(e.g. backup/config files) that may expose plaintext admin passwords without prior
authentication, consistent with CVE-2025-65009 and CVE-2025-65011.
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- .cfg
- .conf
- config.bin
- backup.bin
filter_auth:
cs-uri-query|contains: session=
condition: selection and not filter_auth
falsepositives:
- Authenticated administrators downloading device configuration backups through the
normal management interface
level: medium
tags:
- attack.t1552.001
- attack.credential-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65007
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs