CVE-2025-10325

2.1 lowEPSS 5.6%

Low (2.1) in wavlink wl-wn578w2 firmware. EPSS 5.6% chance of exploitation in the next 30 days.

A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-74
Published: 2025-09-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wavlink:wl-wn578w2_firmware

References

https://github.com/ZZ2266/.github.io/blob/main/WAVLINK/WL-WN578W2/login.cgi/login/readme.md
https://vuldb.com/?ctiid.323751
https://vuldb.com/?id.323751
https://vuldb.com/?submit.643436
https://vuldb.com/?submit.643437

Check your stack JSON