CVE-2025-10358

🗓️ 13 Sep 2025 08:02:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Remote OS command injection in Wavlink WL-WN578W2 via wireless.cgi sub_404850 by delete_list.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-10358	13 Sep 202508:52	–	circl
CNNVD	Wavlink WL-WN578W2 操作系统命令注入漏洞	13 Sep 202500:00	–	cnnvd
CNVD	Wavlink WL-WN578W2 sub_404850 function OS Command Injection Vulnerability	16 Sep 202500:00	–	cnvd
Cvelist	CVE-2025-10358 Wavlink WL-WN578W2 wireless.cgi sub_404850 os command injection	13 Sep 202508:02	–	cvelist
EUVD	EUVD-2025-29091	3 Oct 202520:07	–	euvd
NVD	CVE-2025-10358	13 Sep 202508:15	–	nvd
Positive Technologies	PT-2025-37366	28 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-10358	15 Sep 202508:33	–	redhatcve
Vulnrichment	CVE-2025-10358 Wavlink WL-WN578W2 wireless.cgi sub_404850 os command injection	13 Sep 202508:02	–	vulnrichment

NVD

Vulners

Node

wavlink wl-wn578w2_firmwareMatchm78w2_v221110

AND

wavlink wl-wn578w2Match-

[
  {
    "vendor": "Wavlink",
    "product": "WL-WN578W2",
    "versions": [
      {
        "version": "221110",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/DeleteMac
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/DeleteMac

Parameter	Position	Path	Description	CWE
delete_list	query param	/cgi-bin/wireless.cgi	OS command injection in /cgi-bin/wireless.cgi function sub_404850 via delete_list parameter	CWE-78, CWE-77

29 Apr 2026 01:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.3 - 9.8

CVSS 46.9

CVSS 27.5

CVSS 37.3

EPSS0.0102

SSVC