CVE-2025-44882
Published: 20 May 2025
Summary
CVE-2025-44882 is a critical-severity OS Command Injection (CWE-78) vulnerability in Wavlink Wl-Wn579A3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A command injection vulnerability tracked as CVE-2025-44882 affects the /cgi-bin/firewall.cgi component of the Wavlink WL-WN579A3 router running firmware version 1.0. The issue, assigned CWE-78 and rated 9.8 on CVSS 3.1, stems from insufficient input validation that permits arbitrary operating-system commands to be executed when specially crafted data is supplied to the script.
Unauthenticated attackers with network access can exploit the flaw remotely without user interaction, achieving full control over the device including the ability to read, modify, or delete data and potentially pivot to other systems on the local network. The published EPSS score of 0.1446 has remained flat at its peak value, indicating moderate but stable exploitation interest since disclosure.
A technical write-up detailing the remote command execution path is available at the referenced GitHub page, though no vendor advisory or firmware patch information is provided in the current references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15971
Vulnerability details
A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.