WODESYS routers exposed by five critical flaws
Five vulnerabilities in WODESYS WD-R608U routers enable unauthenticated attackers to execute commands, change passwords, and access plaintext credentials.
CERT Polska has disclosed five vulnerabilities affecting WODESYS WD-R608U routers (also sold as WDR122B V2.0 and WDR28). The flaws collectively allow unauthenticated remote attackers to fully compromise affected devices through multiple attack vectors. CVE-2025-65007 permits unauthenticated configuration changes including backup creation and factory resets via the adm.cgi endpoint. CVE-2025-65008 enables command injection through insufficient validation of the langGet parameter. CVE-2025-65009 exposes admin passwords stored in plaintext within configuration files accessible to unauthorized users.
Two additional access control vulnerabilities compound the exposure. CVE-2025-65010 affects the initial configuration wizard.cgi endpoint, allowing attackers to change the admin password without authorization even after initial setup is complete. CVE-2025-65011 permits unauthorized viewing of configuration files through direct resource references. The vendor was notified but did not respond with details or a vulnerability scope. Only firmware version WDR28081123OV1.01 was confirmed vulnerable during testing; other versions remain untested and potentially affected.
The vulnerability chain effectively grants complete device control to unauthenticated attackers, who can extract credentials, modify configurations, execute arbitrary commands, and maintain persistent access. Organizations using these routers should assume compromise and implement compensating controls including network segmentation and replacement with patched or alternative hardware.
Mentioned in this report
Detection guidance
WODESYS Router Unauthenticated adm.cgi Configuration Change
Detects unauthenticated HTTP requests to the adm.cgi endpoint on WODESYS WD-R608U/WDR122B/WDR28 routers requesting backup, restore, or factory-reset actions, indicative of CVE-2025-65007 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Unauthenticated adm.cgi Configuration Change
id: 3e4220ec-cf1c-565a-9e48-327f4bca3406
status: experimental
description: Detects HTTP requests to the adm.cgi endpoint on WODESYS routers invoking
backup, restore, or reset actions without prior authentication, consistent with
CVE-2025-65007.
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: adm.cgi
cs-uri-query|contains:
- backup
- restore
- reset
- factory
filter_auth:
cs-uri-query|contains: session=
condition: selection and not filter_auth
falsepositives:
- Legitimate administrative backup or factory-reset operations performed by an authenticated
network administrator using a valid session token
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
WODESYS Router Command Injection via langGet Parameter
Detects HTTP requests containing shell metacharacters in the langGet parameter of WODESYS router CGI endpoints, indicative of command injection exploitation (CVE-2025-65008). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Command Injection via langGet Parameter
id: 6c547f17-945e-5f94-857b-969a61f96b35
status: experimental
description: Detects requests where the langGet CGI parameter contains shell metacharacters
or command chaining sequences, consistent with unauthenticated command injection
on WODESYS routers (CVE-2025-65008).
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: langGet=
injection_chars:
cs-uri-query|contains:
- ;
- '|'
- '&&'
- '`'
- $(
- '%0a'
- '%3b'
condition: selection and injection_chars
falsepositives:
- Automated vulnerability scanners or penetration testing tools deliberately probing
the langGet parameter
falsepositives_note: none
level: high
tags:
- attack.t1059.004
- attack.execution
author: Vorant
WODESYS Router Plaintext Configuration File Access Attempt
Detects unauthenticated requests to configuration file resources on WODESYS routers that may expose plaintext admin credentials, consistent with CVE-2025-65009 and CVE-2025-65011. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router Plaintext Configuration File Access Attempt
id: f5fd5a9c-2d67-5cbd-bd04-bf630a93ac61
status: experimental
description: Detects direct HTTP requests to WODESYS router configuration file endpoints
(e.g. backup/config files) that may expose plaintext admin passwords without prior
authentication, consistent with CVE-2025-65009 and CVE-2025-65011.
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- .cfg
- .conf
- config.bin
- backup.bin
filter_auth:
cs-uri-query|contains: session=
condition: selection and not filter_auth
falsepositives:
- Authenticated administrators downloading device configuration backups through the
normal management interface
level: medium
tags:
- attack.t1552.001
- attack.credential_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65007
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free