A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/firewall.cgi/websSysFirewall | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.323750 | Permissions Required VDB Entry |
| https://vuldb.com/?id.323750 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.643435 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
02 Oct 2025, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/firewall.cgi/websSysFirewall - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.323750 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.323750 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.643435 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:h:wavlink:wl-wn578w2:-:*:*:*:*:*:*:* cpe:2.3:o:wavlink:wl-wn578w2_firmware:m78w2_v221110:*:*:*:*:*:*:* |
|
| First Time |
Wavlink wl-wn578w2 Firmware
Wavlink wl-wn578w2 Wavlink |
12 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-12 20:15
Updated : 2025-10-02 19:45
NVD link : CVE-2025-10324
Mitre link : CVE-2025-10324
CVE.ORG link : CVE-2025-10324
JSON object : View
Products Affected
wavlink
- wl-wn578w2
- wl-wn578w2_firmware