CVE-2025-68715
CriticalSummary
An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirelessBasic) that do not enforce authentication. A remote unauthenticated attacker can modify WAN, LAN, and wireless settings directly, leading to privilege escalation and denial of service.
Risk Assessment
The risk includes unauthorized modification of network configuration, which can disrupt device and network operations, and potentially allow the attacker to take control of the device.
Recommendation
It is recommended to immediately restrict access to these endpoints (e.g., via firewall) and contact the vendor for a firmware update.
Original NVD description (English source)
An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirelessBasic) that do not enforce authentication. A remote unauthenticated attacker can modify WAN, LAN, and wireless settings directly, leading to privilege escalation and denial of service.