CVE-2025-10324 is a high severity flaw in the Wavlink WL-WN578W2 firmware 221110 router, scored 7.3 by NVD. It allows OS command injection through the pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled and remoteManagementEnabled argument at firewall.cgi. The record lists no fixed version, so keep the management interface off untrusted networks and check the vendor for new firmware.
What's affected
The record names Wavlink WL-WN578W2 firmware 221110. The affected code is the sub_401C5C function in firewall.cgi. The vulnerable input is the pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled and remoteManagementEnabled parameters. The record states that the vendor was contacted early about the disclosure and did not respond.
No fixed version appears in the record or in the reference pages I could read. Do not assume a later release is safe. Check the vendor or project page for a patched release, and if none exists, plan on mitigation or replacement. The same product has sibling reports with different entry points: CVE-2025-10323, CVE-2025-10358 and CVE-2025-10359. Fixing one endpoint does not fix the others.
The record says the exploit has been published and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Start with the device list. Find every Wavlink WL-WN578W2 unit on your network, including ones installed as range extenders or access points. The router's admin page shows the firmware version, and the record names version 221110.
Then check where the web interface is reachable from. Test from outside your network and from guest or untrusted segments. If the admin page answers, the exposure is real. Applications like this are usually installed by copying source files to a server, so no package manager records them and a dependency scan may not list them. Gold's free in-browser dependency scan still covers the libraries that sit next to them, and your own asset list is the place to find the application itself.
You can also look at traffic to the device. Requests to firewall.cgi with unusual values in pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled and remoteManagementEnabled are worth a closer look. There is no vendor advisory to follow, so your own network records are the main evidence.
What to do now
- List every WL-WN578W2 unit and note its firmware version.
- Make sure the web management interface is not reachable from the internet or from guest networks.
- Turn off remote management if it is enabled.
- Restrict admin access to a single trusted host or VLAN, and change default or shared admin passwords.
- Check the Wavlink support site for a firmware newer than 221110 and apply it if one is listed. The record says the vendor did not respond to the disclosure.
- If no fixed firmware arrives, plan to replace the device, especially where it sits on a network with sensitive systems.
- Review the device settings for changes you did not make.
Why it matters
This is command injection, listed under CWE-74 (injection), CWE-77 (command injection). A value sent to the router's web interface ends up inside a shell command on the device. If the firmware does not clean that value, the shell can be made to run something the manufacturer never intended. On a router that means the device that carries your traffic can be taken over.
Network devices matter more than their price suggests. They sit at the edge, they rarely get monitoring or logging, and firmware updates are slow or absent. This is one of several reports against the same model (CVE-2025-10323, CVE-2025-10358 and CVE-2025-10359), each through a different handler. A patch has to cover all of them. The score of 7.3 comes from network reach, low complexity and no privileges required, with low impact ratings in the vector. Those ratings are generic, and a device takeover can matter more than they suggest.
Quick check
Is CVE-2025-10324 exploited in the wild?
The record does not say so, and it is not on the CISA Known Exploited Vulnerabilities list. The record does say a public exploit exists, so do not wait.
What is the safest short term step?
Make sure the router's admin interface cannot be reached from the internet or from untrusted networks, and turn off remote management.
Sources
Last reviewed: 19 October 2026.
