CVE-2025-44868

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-02 · updated 2026-06-17
Weakness: CWE-77

Description

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

Wavlink Wl-Wn530H4 Firmware: 20220801

References

https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WL-WN530H4/ping_test/readme.md
https://github.com/Summermu/VulnForIoT/blob/main/Wavlink_WL-WN530H4/ping_test/readme.md

Get alerted when CVE-2025-44868 or the next vulnerability affects your stack