WODESYS WD-R608U routers allow unauthenticated remote code execution
CERT Polska disclosed five critical vulnerabilities in WODESYS WD-R608U routers enabling unauthenticated remote command execution and complete device compromise.
Sourcecert.pl — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of five vulnerabilities affecting WODESYS WD-R608U routers, also marketed as WDR122B V2.0 and WDR28. The flaws include unauthenticated command execution via the adm.cgi endpoint (CVE-2025-65007), command injection through the langGet parameter (CVE-2025-65008), plaintext password storage (CVE-2025-65009), broken access control in the configuration wizard allowing password changes without authentication (CVE-2025-65010), and unauthorized access to configuration files (CVE-2025-65011). The vulnerabilities were reported by security researcher Wojciech Cybowski.
Version WDR28081123OV1.01 was confirmed vulnerable during testing. The vendor was notified early in the disclosure process but did not respond with details about affected version ranges or remediation timelines. The combination of authentication bypass, command injection, and plaintext credential storage allows complete unauthenticated compromise of affected devices. Organizations using these router models should assume they are vulnerable until vendor patches become available.
These vulnerabilities represent a critical risk for any organization deploying these consumer-grade routers, particularly in small office or home office environments. The lack of vendor response raises concerns about whether security updates will be released.
Mentioned in this report
Detection guidance
HTTP Request to WODESYS adm.cgi Endpoint with Shell Metacharacters
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to the adm.cgi CGI endpoint on WODESYS WD-R608U/WDR122B/WDR28 routers containing shell metacharacters indicative of unauthenticated command execution (CVE-2025-65007). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request to WODESYS adm.cgi Endpoint with Shell Metacharacters
id: 23ebdb84-9e29-5662-ac07-e65c87be93e0
status: experimental
description: 'Detects HTTP requests targeting the adm.cgi endpoint exposed by WODESYS
WD-R608U (also sold as WDR122B V2.0, WDR28) routers, containing shell metacharacters
or command chaining sequences that indicate an attempt to exploit unauthenticated
command execution (CVE-2025-65007).
'
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /adm.cgi
selection_injection:
cs-uri-query|contains:
- ;
- '`'
- '|'
- $(
- '&&'
- $IFS
- 'wget '
- 'curl '
- /bin/sh
- busybox
condition: selection_endpoint and selection_injection
falsepositives:
- Legitimate configuration scripts or vendor management tools that pass complex parameters
containing similar characters (rare for this endpoint)
level: high
WODESYS Router langGet Parameter Command Injection Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing the langGet parameter with embedded shell command sequences, indicative of command injection exploitation against WODESYS WD-R608U routers (CVE-2025-65008). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WODESYS Router langGet Parameter Command Injection Attempt
id: 8efd6dbe-52fb-5dc3-afb0-0d62b7a07a46
status: experimental
description: 'Detects HTTP requests where the langGet parameter contains shell metacharacters
or command substitution syntax, consistent with exploitation of the langGet command
injection vulnerability (CVE-2025-65008) in WODESYS WD-R608U routers.
'
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains: langGet=
selection_injection:
cs-uri-query|contains:
- ;
- '`'
- '|'
- $(
- '&&'
- $IFS
- ../
- /bin/sh
condition: selection_param and selection_injection
falsepositives:
- Legitimate localization/language selection requests are extremely unlikely to contain
shell metacharacters; false positives should be rare
level: high
Unauthenticated Access to WODESYS Router Configuration or Password Files
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to configuration or backup file paths on WODESYS WD-R608U routers that may expose plaintext credentials due to broken access control (CVE-2025-65009/65010/65011). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to WODESYS Router Configuration or Password Files
id: 5f3a174e-020b-57c3-a7a4-25ed23bdbbdc
status: experimental
description: 'Detects HTTP requests to configuration wizard or backup/config file
paths on WODESYS WD-R608U routers without an authenticated session, which may indicate
exploitation of broken access control leading to disclosure of plaintext credentials
or unauthorized password changes (CVE-2025-65009, CVE-2025-65010, CVE-2025-65011).
'
references:
- CERT Polska advisory on WODESYS WD-R608U vulnerabilities
author: Vorant
tags:
- attack.t1552.001
- attack.credential-access
logsource:
category: webserver
detection:
selection_config_path:
cs-uri-stem|contains:
- config.bin
- /wizard
- backup.cfg
- password.cgi
- .conf
filter_auth_cookie:
cs-cookie|contains:
- session=
- auth=
condition: selection_config_path and not filter_auth_cookie
falsepositives:
- Legitimate administrators downloading configuration backups through an authenticated
session that uses a differently named cookie not matched by the filter
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65007
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs