CERT Polska disclosed five critical vulnerabilities in WODESYS WD-R608U routers enabling…

CERT Polska disclosed five critical vulnerabilities in WODESYS WD-R608U routers enabling unauthenticated remote command execution and complete device compromise.

CERT Polska coordinated the disclosure of five vulnerabilities affecting WODESYS WD-R608U routers, also marketed as WDR122B V2.0 and WDR28. The flaws include unauthenticated command execution via the adm.cgi endpoint (CVE-2025-65007), command injection through the langGet parameter (CVE-2025-65008), plaintext password storage (CVE-2025-65009), broken access control in the configuration wizard allowing password changes without authentication (CVE-2025-65010), and unauthorized access to configuration files (CVE-2025-65011). The vulnerabilities were reported by security researcher Wojciech Cybowski.

Version WDR28081123OV1.01 was confirmed vulnerable during testing. The vendor was notified early in the disclosure process but did not respond with details about affected version ranges or remediation timelines. The combination of authentication bypass, command injection, and plaintext credential storage allows complete unauthenticated compromise of affected devices. Organizations using these router models should assume they are vulnerable until vendor patches become available.

These vulnerabilities represent a critical risk for any organization deploying these consumer-grade routers, particularly in small office or home office environments. The lack of vendor response raises concerns about whether security updates will be released.

title: HTTP Request to WODESYS adm.cgi Endpoint with Shell Metacharacters
id: 23ebdb84-9e29-5662-ac07-e65c87be93e0
status: experimental
description: 'Detects HTTP requests targeting the adm.cgi endpoint exposed by WODESYS
  WD-R608U (also sold as WDR122B V2.0, WDR28) routers, containing shell metacharacters
  or command chaining sequences that indicate an attempt to exploit unauthenticated
  command execution (CVE-2025-65007).

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: /adm.cgi
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '`'
    - '|'
    - $(
    - '&&'
    - $IFS
    - 'wget '
    - 'curl '
    - /bin/sh
    - busybox
  condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate configuration scripts or vendor management tools that pass complex parameters
  containing similar characters (rare for this endpoint)
level: high

title: WODESYS Router langGet Parameter Command Injection Attempt
id: 8efd6dbe-52fb-5dc3-afb0-0d62b7a07a46
status: experimental
description: 'Detects HTTP requests where the langGet parameter contains shell metacharacters
  or command substitution syntax, consistent with exploitation of the langGet command
  injection vulnerability (CVE-2025-65008) in WODESYS WD-R608U routers.

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: langGet=
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '`'
    - '|'
    - $(
    - '&&'
    - $IFS
    - ../
    - /bin/sh
  condition: selection_param and selection_injection
falsepositives:
- Legitimate localization/language selection requests are extremely unlikely to contain
  shell metacharacters; false positives should be rare
level: high

title: Unauthenticated Access to WODESYS Router Configuration or Password Files
id: 5f3a174e-020b-57c3-a7a4-25ed23bdbbdc
status: experimental
description: 'Detects HTTP requests to configuration wizard or backup/config file
  paths on WODESYS WD-R608U routers without an authenticated session, which may indicate
  exploitation of broken access control leading to disclosure of plaintext credentials
  or unauthorized password changes (CVE-2025-65009, CVE-2025-65010, CVE-2025-65011).

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1552.001
- attack.credential-access
logsource:
  category: webserver
detection:
  selection_config_path:
    cs-uri-stem|contains:
    - config.bin
    - /wizard
    - backup.cfg
    - password.cgi
    - .conf
  filter_auth_cookie:
    cs-cookie|contains:
    - session=
    - auth=
  condition: selection_config_path and not filter_auth_cookie
falsepositives:
- Legitimate administrators downloading configuration backups through an authenticated
  session that uses a differently named cookie not matched by the filter
level: medium

Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65007