# CERT Polska disclosed five critical vulnerabilities in WODESYS WD-R608U routers enabling…

Published: 2025-12-18 · Severity: critical
Canonical: https://vorant.io/reports/c385d174-f4fe-4f5b-96e8-30aa22661c0c/cert-polska-disclosed-five-critical-vulnerabilities-in-wodesys-wd-r608u-routers

> CERT Polska disclosed five critical vulnerabilities in WODESYS WD-R608U routers enabling unauthenticated remote command execution and complete device compromise.

CERT Polska coordinated the disclosure of five vulnerabilities affecting WODESYS WD-R608U routers, also marketed as WDR122B V2.0 and WDR28. The flaws include unauthenticated command execution via the adm.cgi endpoint (CVE-2025-65007), command injection through the langGet parameter (CVE-2025-65008), plaintext password storage (CVE-2025-65009), broken access control in the configuration wizard allowing password changes without authentication (CVE-2025-65010), and unauthorized access to configuration files (CVE-2025-65011). The vulnerabilities were reported by security researcher Wojciech Cybowski.

Version WDR28081123OV1.01 was confirmed vulnerable during testing. The vendor was notified early in the disclosure process but did not respond with details about affected version ranges or remediation timelines. The combination of authentication bypass, command injection, and plaintext credential storage allows complete unauthenticated compromise of affected devices. Organizations using these router models should assume they are vulnerable until vendor patches become available.

These vulnerabilities represent a critical risk for any organization deploying these consumer-grade routers, particularly in small office or home office environments. The lack of vendor response raises concerns about whether security updates will be released.

## Mentioned in this report

- Vulnerabilities: CVE-2025-65007, CVE-2025-65008, CVE-2025-65009, CVE-2025-65010, CVE-2025-65011

## Detection guidance (public sample)

### HTTP Request to WODESYS adm.cgi Endpoint with Shell Metacharacters

ATT&CK: T1190

Detects unauthenticated HTTP requests to the adm.cgi CGI endpoint on WODESYS WD-R608U/WDR122B/WDR28 routers containing shell metacharacters indicative of unauthenticated command execution (CVE-2025-65007). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request to WODESYS adm.cgi Endpoint with Shell Metacharacters
id: 23ebdb84-9e29-5662-ac07-e65c87be93e0
status: experimental
description: 'Detects HTTP requests targeting the adm.cgi endpoint exposed by WODESYS
  WD-R608U (also sold as WDR122B V2.0, WDR28) routers, containing shell metacharacters
  or command chaining sequences that indicate an attempt to exploit unauthenticated
  command execution (CVE-2025-65007).

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: /adm.cgi
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '`'
    - '|'
    - $(
    - '&&'
    - $IFS
    - 'wget '
    - 'curl '
    - /bin/sh
    - busybox
  condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate configuration scripts or vendor management tools that pass complex parameters
  containing similar characters (rare for this endpoint)
level: high
```

### WODESYS Router langGet Parameter Command Injection Attempt

ATT&CK: T1190

Detects HTTP requests containing the langGet parameter with embedded shell command sequences, indicative of command injection exploitation against WODESYS WD-R608U routers (CVE-2025-65008). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WODESYS Router langGet Parameter Command Injection Attempt
id: 8efd6dbe-52fb-5dc3-afb0-0d62b7a07a46
status: experimental
description: 'Detects HTTP requests where the langGet parameter contains shell metacharacters
  or command substitution syntax, consistent with exploitation of the langGet command
  injection vulnerability (CVE-2025-65008) in WODESYS WD-R608U routers.

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: langGet=
  selection_injection:
    cs-uri-query|contains:
    - ;
    - '`'
    - '|'
    - $(
    - '&&'
    - $IFS
    - ../
    - /bin/sh
  condition: selection_param and selection_injection
falsepositives:
- Legitimate localization/language selection requests are extremely unlikely to contain
  shell metacharacters; false positives should be rare
level: high
```

### Unauthenticated Access to WODESYS Router Configuration or Password Files

ATT&CK: T1552.001

Detects unauthenticated HTTP requests to configuration or backup file paths on WODESYS WD-R608U routers that may expose plaintext credentials due to broken access control (CVE-2025-65009/65010/65011). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Access to WODESYS Router Configuration or Password Files
id: 5f3a174e-020b-57c3-a7a4-25ed23bdbbdc
status: experimental
description: 'Detects HTTP requests to configuration wizard or backup/config file
  paths on WODESYS WD-R608U routers without an authenticated session, which may indicate
  exploitation of broken access control leading to disclosure of plaintext credentials
  or unauthorized password changes (CVE-2025-65009, CVE-2025-65010, CVE-2025-65011).

  '
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1552.001
- attack.credential-access
logsource:
  category: webserver
detection:
  selection_config_path:
    cs-uri-stem|contains:
    - config.bin
    - /wizard
    - backup.cfg
    - password.cgi
    - .conf
  filter_auth_cookie:
    cs-cookie|contains:
    - session=
    - auth=
  condition: selection_config_path and not filter_auth_cookie
falsepositives:
- Legitimate administrators downloading configuration backups through an authenticated
  session that uses a differently named cookie not matched by the filter
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65007

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c385d174-f4fe-4f5b-96e8-30aa22661c0c/cert-polska-disclosed-five-critical-vulnerabilities-in-wodesys-wd-r608u-routers.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup