CVE-2025-65010: Missing authorizations for admin panel password change in WODESYS WD-R608U router

Published Dec 18, 2025

Updated

WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious attacker can change admin panel password without authorization. The vulnerability can also be exploited after the initial configuration has been set.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected Software

1 affected component

WODESYS WD-R608U

Event History

Dec 18, 2025

CVE Published

via MITRE·03:10 PM

Data Sourced

via MITRE·03:10 PM

DescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-65010?

CVE-2025-65010 is classified as a medium severity vulnerability due to its potential to allow unauthorized access to the admin panel.

How do I fix CVE-2025-65010?

To mitigate CVE-2025-65010, update the firmware of the WODESYS WD-R608U router to the latest version provided by the manufacturer.

What type of vulnerability is CVE-2025-65010?

CVE-2025-65010 is a Broken Access Control vulnerability that allows an attacker to change the admin panel password without proper authorization.

Which devices are affected by CVE-2025-65010?

CVE-2025-65010 affects the WODESYS WD-R608U router, also known as WDR122B V2.0 and WDR28.

Is CVE-2025-65010 remotely exploitable?

Yes, CVE-2025-65010 can be exploited remotely by attackers without physical access to the device.