Broken Access Control Flaw in WODESYS Router Vulnerability

CVE-2025-65010

What is CVE-2025-65010?

The WODESYS WD-R608U router, also recognized as WDR122B V2.0 and WDR28, contains a severe flaw in its initial configuration wizard.cgi endpoint. This vulnerability allows attackers to maliciously alter the admin panel password without requisite authorization. Not only can this flaw be exploited during the initial setup, but it also remains a threat even post-configuration, potentially leaving the system exposed. Despite early notification to the vendor regarding this issue, no comprehensive information was provided about vulnerable versions beyond the confirmed WDR28081123OV1.01, leaving uncertainty around other versions.

References