CVE-2025-10385
📋 TL;DR
A buffer overflow vulnerability in Mercury KM08-708H GiGA WiFi Wave2 routers allows remote attackers to execute arbitrary code by manipulating the ChgUserId parameter. This affects all users of version 1.1 of this specific router model. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Mercury KM08-708H GiGA WiFi Wave2
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, network traffic interception, credential theft, and lateral movement to connected devices.
Likely Case
Router takeover allowing attacker to modify network settings, intercept traffic, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making weaponization likely. Remote exploitation without authentication is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates. If unavailable, consider replacement.
🔧 Temporary Workarounds
Network Isolation
allPlace router behind firewall with strict inbound rules and disable WAN administration
Access Restriction
allRestrict administrative access to specific IP addresses only
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Implement strict network segmentation to isolate vulnerable routers from critical assets
🔍 How to Verify
Check if Vulnerable:
Check router web interface or CLI for firmware version. If version is 1.1, device is vulnerable.Check Version:
Check router web interface at http://[router-ip]/ or use telnet/ssh if availableVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.1📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/mcr_setSysAdm with long ChgUserId parameters
- Multiple failed login attempts followed by buffer overflow patterns
Network Indicators:
- Unusual traffic patterns from router IP
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND uri="/goform/mcr_setSysAdm" AND (param_length>100 OR contains(param,"ChgUserId"))