CVE-2025-10321CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2025-10321

Medium · published September 12, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00531 · 44.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2025-09-12T22:15Z
Affected products (1)
ProductVersionsFixed in
wavlink/wl-wn578w2_firmwareall versions—
References (4)
https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/live_online.shtml · [email protected]https://vuldb.com/?ctiid.323747 · [email protected]https://vuldb.com/?id.323747 · [email protected]https://vuldb.com/?submit.643431 · [email protected]
EPSS history
Timeline
  • 12 SEP 17:32Z
    Wavlink WL-WN578W2 live_online.shtml information disclosure
    cvelistv5