WODESYS WD-R608U Router Broken Access Control Vulnerability in Password Management

A broken access control vulnerability has been identified in the WODESYS WD-R608U router, also known as the WDR122B V2.0 and WDR28 models. This vulnerability allows unauthorized attackers to change the admin panel password through the initial configuration 'wizard.cgi' endpoint. The issue persists even after the initial setup is completed. While the vendor was notified about this vulnerability, they did not provide details regarding the affected version range. The vulnerability has been confirmed in the WDR28081123OV1.01 version, but other versions may also be susceptible.

Impact

Exploitation of this vulnerability allows for unauthorized password changes in the admin panel, potentially leading to unauthorized administrative access.