CVE-2025-10358: Wavlink WL-WN578W2 wireless.cgi sub_404850 os command injection

Published Sep 13, 2025

Updated

A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument deletelist leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

3 affected components

Wavlink WL-WN578W2

All of the following

Wavlink Wl-wn578w2 Firmware=m78w2_v221110

Wavlink WL-WN578W2

Event History

Sep 13, 2025

CVE Published

via MITRE·08:02 AM

Data Sourced

via MITRE·08:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10358?

CVE-2025-10358 is rated as a high severity vulnerability due to its potential for remote exploitation through OS command injection.

How does CVE-2025-10358 affect Wavlink WL-WN578W2?

CVE-2025-10358 affects the Wavlink WL-WN578W2 by allowing an attacker to manipulate the 'delete_list' argument in '/cgi-bin/wireless.cgi' to execute arbitrary system commands.

What types of attacks can be executed using CVE-2025-10358?

An attacker can initiate remote OS command injection attacks using CVE-2025-10358.

How can I mitigate the risks associated with CVE-2025-10358?

To mitigate the risks of CVE-2025-10358, ensure your Wavlink WL-WN578W2 firmware is updated to the latest version that addresses this vulnerability.

Is CVE-2025-10358 a local or remote vulnerability?

CVE-2025-10358 is a remote vulnerability, allowing exploitation from outside the target network.