CVE-2025-65008 is an OS command injection vulnerability classified under CWE-78, affecting the WODESYS WD-R608U router series, including models WDR122B V2.0 and WDR28. The vulnerability is due to insufficient input validation of the 'langGet' parameter in the adm.cgi endpoint, which is accessible remotely. An attacker can exploit this flaw by crafting malicious requests that inject arbitrary shell commands, leading to full system compromise. The vulnerability requires no authentication or user interaction, significantly increasing its exploitability. The only confirmed vulnerable firmware version is WDR28081123OV1.01, but the lack of vendor response and testing on other versions suggests a broader impact. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) indicates that the attack can be performed remotely over the network with low complexity and no privileges, resulting in high confidentiality, integrity, and availability impacts. The absence of patches or mitigation guidance from the vendor exacerbates the risk. Although no exploits have been observed in the wild, the vulnerability's nature makes it a prime target for attackers aiming to gain control over network infrastructure devices.

For European organizations, this vulnerability poses a severe threat to network security and operational continuity. Exploitation can lead to unauthorized access, data exfiltration, manipulation or destruction of data, and disruption of network services. Given that routers are critical infrastructure components, compromise could facilitate lateral movement within networks, enabling attackers to target sensitive systems or launch further attacks. Industrial, governmental, and enterprise sectors relying on WODESYS routers may face operational downtime, financial losses, and reputational damage. The lack of vendor patches increases the window of exposure, and the vulnerability's ease of exploitation means even low-skilled attackers could leverage it. Additionally, the potential for attackers to install persistent backdoors or malware could have long-term security implications. European data protection regulations (e.g., GDPR) may also impose legal consequences if breaches occur due to this vulnerability.

1. Immediately isolate affected WODESYS WD-R608U routers from untrusted networks, especially the internet, to prevent remote exploitation. 2. Disable remote administration interfaces or restrict access to trusted IP addresses only. 3. Implement strict network segmentation to limit the router's access to critical internal systems. 4. Monitor network traffic and device logs for unusual or unauthorized commands targeting the adm.cgi endpoint or the 'langGet' parameter. 5. Conduct thorough inventory and firmware version audits to identify all potentially vulnerable devices. 6. Engage with WODESYS or authorized vendors to request firmware updates or patches; if unavailable, consider replacing affected hardware with secure alternatives. 7. Employ intrusion detection/prevention systems (IDS/IPS) with signatures or heuristics capable of detecting command injection attempts. 8. Educate network administrators about this vulnerability and enforce strong operational security practices. 9. Prepare incident response plans specifically addressing potential exploitation scenarios involving network infrastructure devices.