CVE-2025-50757: Command Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 1.8% chance of exploitation in 30 days – higher than 78% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Immediate mitigation should include isolating the affected Wavlink WN535K3 devices from critical network segments to limit potential impact. 2. Network administrators should monitor network traffic for unusual activity indicative of exploitation attempts, such as unexpected outbound connections or command execution patterns. 3. Implement strict access controls on router management interfaces, restricting access to trusted IP addresses and enforcing strong authentication mechanisms. 4. Disable remote management features if not required to reduce the attack surface. 5. 6. Employ network segmentation and intrusion detection/prevention systems to detect and contain potential compromises. 7. For organizations with security operations centers, incorporate detection signatures specific to command injection attempts targeting the username parameter of the set_sys_adm function. 8. Consider replacing vulnerable devices with models from vendors with stronger security track records if immediate patching is not feasible.
Description
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.