CVE-2025-65008: OS Command Injection in WODESYS WD-R608U router

Published Dec 18, 2025

Updated

In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected Software

1 affected component

WODESYS WD-R608U router

Event History

Dec 18, 2025

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-65008?

CVE-2025-65008 is considered a high severity vulnerability due to the potential for an attacker to execute arbitrary system shell commands.

How do I fix CVE-2025-65008?

The recommended fix for CVE-2025-65008 is to immediately apply any firmware updates provided by the vendor, WODESYS.

What are the risks associated with CVE-2025-65008?

The risks of CVE-2025-65008 include unauthorized system access, data breach, and the potential for complete control over the vulnerable WODESYS WD-R608U router.

Which devices are affected by CVE-2025-65008?

CVE-2025-65008 affects the WODESYS WD-R608U router and its variants including WDR122B V2.0 and WDR28.

Is there a workaround for CVE-2025-65008?

Currently, there are no known workarounds for CVE-2025-65008, making it essential to apply the vendor's recommended updates.