WODESYS vulnerabilities
We track 5 vulnerabilities in WODESYS products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on December 18, 2025.
Latest WODESYS vulnerabilities
- 7.1 High severity
WD-R608U: Direct Request
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in question. The vendor was notified early about this vulnerability, but didn't respond with the details of
- 7.1 High severity
WD-R608U: Missing Authentication for Critical Functionality
WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious attacker can change admin panel password without authorization. The vulnerability can also be exploite
- 7.1 High severity
WD-R608U: Plaintext Storage of a Password
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question. The vendor was notified early about this vu
- 9.4 Critical severity
WD-R608U: Improper Neutralization of Special Elements used in an OS Command
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands. The vendor was notified early about this vulnerability, but
- 8.7 High severity
WD-R608U: Missing Authentication for Critical Functionality
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the unauthenticated attacker can execute commands including backup creation, device restart and resettin