CVE-2025-68715

critical · 9.1

An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirelessBasic) that do not enforce authentication. A remote unauthenticated attacker can modify WAN, LAN, and wireless settings directly, leading to privilege escalation and denial of service.

9.1

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-01-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-306

Affected products

Vendor	Product	Affected versions
pandawireless	pwru01_firmware	2.2.9
pandawireless	pwru01	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/actuator/cve/blob/main/PandaWireless/CVE-2025-68715.txt
https://github.com/actuator/cve/tree/main/PandaWireless

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-68715