WODESYS WD-R608U Router OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the WODESYS WD-R608U router, also known as the WDR122B V2.0 and WDR28. This vulnerability arises from inadequate validation of the langGet parameter in the adm.cgi endpoint, allowing attackers to execute arbitrary system shell commands. While the vendor was notified about this issue, they did not provide details on the vulnerability or its affected version range. The vulnerability has been confirmed in version WDR28081123OV1.01, but other versions may also be susceptible.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the router's operating system.