Authentication Flaw in WODESYS WD-R608U Router Exposes Command Execution Risk

CVE-2025-65007

What is CVE-2025-65007?

The WODESYS WD-R608U router, also identified as WDR122B V2.0 and WDR28, is affected by a significant authentication flaw. This vulnerability allows unauthenticated attackers to access the configuration change module via the adm.cgi endpoint, enabling them to execute potentially harmful commands. With this access, an attacker could create device backups, restart the router, or even reset it to factory settings, compromising the integrity and availability of the device. Although only one version has been confirmed vulnerable, there remains potential for other versions to possess similar security weaknesses, highlighting the urgency for users to assess their devices.

References