Loading story…
Several critical vulnerabilities have been disclosed in the WODESYS WD-R608U router, including missing authentication for critical functions, OS command injection, plaintext password storage, and forced browsing issues. The most severe, CVE-2025-65007, allows unauthenticated attackers to execute sensitive operations such as backup creation, device restart, and factory reset via the adm.cgi endpoint due to a lack of authentication controls. Other vulnerabilities, such as CVE-2025-65008 (OS command injection) and CVE-2025-65009 (plaintext password storage), further increase the risk of compromise for devices running vulnerable firmware versions (WDR28081123OV1.01).
CERT Polska coordinated the disclosure of these vulnerabilities and confirmed that multiple models, including those also known as WDR122B V2.0 and WDR28, are affected. The vulnerabilities stem from improper authentication and input validation, exposing the routers to remote exploitation. Organizations using these devices should review available patches or mitigations and consider the risks of continued deployment without remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-65007, covering a missing authentication flaw in the WODESYS WD-R608U router, was publicly listed with a CVSS 4.0 score of 8.7. The disclosure described the issue as allowing unauthorized access to critical device functions.
The vulnerabilities were reported to CERT Polska, which coordinated their disclosure. According to the disclosure, the vendor did not provide further details or confirm the full affected version range beyond the tested firmware.
Wojciech Cybowski identified multiple critical vulnerabilities in the WODESYS WD-R608U router, including missing authentication, OS command injection, plaintext password storage, broken access control, and forced browsing, in firmware version WDR28081123OV1.01. The issues could let unauthenticated attackers take control of the device, execute commands, and access or change sensitive configuration and credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026