GCVE - cpe:2.3:a:wodesys:wdr28:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wodesys:wdr28:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Wodesys (`e13078de-827a-5f68-8013-193ae3642583`)
Product	Wdr28 (`2ce69b3a-bdcd-53e7-9b92-71e20bbd6930`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-65011`	vulnerable	2026-06-08 07:39:20.617931	Unauthorized Access to files in WODESYS WD-R608U router In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in question. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Published: 2025-12-18T15:10:35.763Z Updated: 2025-12-18T18:51:50.142Z Open on db.gcve.eu Reference links http://www.wodesys.com/eproductms52.html https://cert.pl/posts/2025/12/CVE-2025-65007 https://github.com/wcyb/security_research	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65010`	vulnerable	2026-06-08 07:39:20.617355	Missing authorizations for admin panel password change in WODESYS WD-R608U router WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious attacker can change admin panel password without authorization. The vulnerability can also be exploited after the initial configuration has been set. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Published: 2025-12-18T15:10:34.174Z Updated: 2025-12-18T18:51:57.363Z Open on db.gcve.eu Reference links http://www.wodesys.com/eproductms52.html https://cert.pl/posts/2025/12/CVE-2025-65007 https://github.com/wcyb/security_research	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65009`	vulnerable	2026-06-08 07:39:20.616627	Insecure Password Storage in WODESYS WD-R608U router In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Published: 2025-12-18T15:10:31.234Z Updated: 2025-12-18T18:52:06.654Z Open on db.gcve.eu Reference links http://www.wodesys.com/eproductms52.html https://cert.pl/en/posts/2025/12/CVE-2025-65007 https://github.com/wcyb/security_research	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65008`	vulnerable	2026-06-08 07:39:20.616125	OS Command Injection in WODESYS WD-R608U router In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Published: 2025-12-18T15:10:27.392Z Updated: 2025-12-18T18:52:13.794Z Open on db.gcve.eu Reference links http://www.wodesys.com/eproductms52.html https://cert.pl/en/posts/2025/12/CVE-2025-65007 https://github.com/wcyb/security_research	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-65007`	vulnerable	2026-06-08 07:39:20.614873	Missing Authentication for Critical Function in WODESYS WD-R608U router In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the unauthenticated attacker can execute commands including backup creation, device restart and resetting the device to factory settings. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Published: 2025-12-18T15:10:22.464Z Updated: 2025-12-18T18:52:21.718Z Open on db.gcve.eu Reference links http://www.wodesys.com/eproductms52.html https://cert.pl/en/posts/2025/12/CVE-2025-65007 https://github.com/wcyb/security_research	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.