CVE-2025-10324
HIGHWavlink Wl-wn578w2 Firmware - Command Injection
Title source: ruleDescription
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
References (4)
Scores
CVSS v3
7.3
EPSS
0.0021
EPSS Percentile
43.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Classification
CWE
CWE-74
CWE-77
Status
published
Affected Products (1)
wavlink/wl-wn578w2_firmware
Timeline
Published
Sep 12, 2025
Tracked Since
Feb 18, 2026