CVE-2025-10775
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wavlink | wl-nu516u1_firmware | m16u1_v240425 |
| wavlink | wl-nu516u1 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in the Wavlink WL-NU516U1 device's login interface, specifically in the login.cgi program's subroutine sub_4012A0. The vulnerability occurs because the 'ipaddr' parameter is improperly handled and concatenated into a system execution call, allowing an attacker to inject and execute arbitrary commands on the device remotely after login verification. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary commands on the affected device remotely, potentially compromising the device's security and functionality. This could lead to unauthorized control, data manipulation, or disruption of the device's operations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted POST request to the /cgi-bin/login.cgi endpoint with the ipaddr parameter containing a command injection payload. For example, using curl or a Python script to send a request like: curl -X POST -d 'ipaddr=192.168.1.1$(echo 1 >/poc.txt)' http://<device-ip>/cgi-bin/login.cgi. If the device is vulnerable, the command will execute, such as creating a file named poc.txt on the device. Monitoring network traffic for unusual POST requests to /cgi-bin/login.cgi with suspicious ipaddr parameters can also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /cgi-bin/login.cgi interface to trusted users only, such as by implementing network-level access controls or firewall rules. Avoid exposing the device's management interface to untrusted networks. Since the vendor has not responded with a patch, consider disabling the vulnerable service or replacing the device with a secure alternative. Monitoring for exploitation attempts and applying strict authentication policies can also help reduce risk. [1]