CVE-2025-10321 Overview
CVE-2025-10321 is an information disclosure vulnerability in the Wavlink WL-WN578W2 wireless router running firmware version 221110. The flaw resides in an unspecified function within the /live_online.shtml endpoint. Remote attackers can query this resource to obtain sensitive device information without authentication. The exploit has been published, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Unauthenticated remote attackers can retrieve sensitive information from affected Wavlink devices, aiding reconnaissance for follow-on attacks against the network.
Affected Products
- Wavlink WL-WN578W2 hardware device
- Wavlink WL-WN578W2 firmware version 221110 (m78w2_v221110)
- Any deployment exposing the /live_online.shtml interface to untrusted networks
Discovery Timeline
- 2025-09-12 - CVE-2025-10321 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10321
Vulnerability Analysis
The vulnerability affects the /live_online.shtml handler in the WL-WN578W2 web management interface. Server-Side Includes (SHTML) pages on this device render dynamic content pulled from the running configuration and session state. The affected handler exposes this data without enforcing authentication or authorization checks. An attacker reaching the device over the network can request the resource and receive information intended for privileged administrators. The disclosed data supports reconnaissance activities such as identifying connected clients, network topology, or device state that precede targeted attacks.
Root Cause
The root cause is missing access control on a server-side rendered management endpoint. The /live_online.shtml page returns operational data without validating the requester's session. This design flaw maps to [CWE-200], where the application discloses information to actors that should not have access. Because the vendor did not respond to disclosure, no code-level fix has been published.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP GET request to /live_online.shtml on the target device's management interface. If the interface is reachable from the attacker's position, whether on the local wireless network or through a WAN-exposed configuration, the response reveals the protected data. Public exploit material is referenced in a GitHub project repository and cataloged in VulDB entry #323747. No verified exploit code is reproduced here.
Detection Methods for CVE-2025-10321
Indicators of Compromise
- Unauthenticated HTTP GET requests to /live_online.shtml from external or unexpected internal sources
- Repeated crawler-style requests enumerating .shtml pages on Wavlink management interfaces
- Outbound connections from a Wavlink WL-WN578W2 device to unfamiliar hosts following suspicious inbound web activity
- Web server access logs showing successful 200 OK responses to /live_online.shtml without a prior authenticated session
Detection Strategies
- Inspect router or upstream firewall logs for requests targeting /live_online.shtml and correlate with source reputation
- Deploy network intrusion detection signatures that flag anonymous access to Wavlink .shtml endpoints
- Monitor for reconnaissance patterns where the same source enumerates multiple SHTML management pages in sequence
Monitoring Recommendations
- Baseline normal administrative traffic to the router and alert on deviations from known admin IP ranges
- Forward device and firewall logs to a centralized analytics platform for retention and correlation
- Track requests to Wavlink management URIs against threat intelligence feeds referencing VulDB #323747
How to Mitigate CVE-2025-10321
Immediate Actions Required
- Restrict access to the router web management interface to trusted management VLANs or specific administrator IPs
- Disable remote WAN administration on the WL-WN578W2 if it is enabled
- Place vulnerable devices behind a network segment that blocks inbound access to /live_online.shtml
- Audit connected devices and credentials on any network where the WL-WN578W2 has been deployed
Patch Information
No vendor patch is available. The vendor did not respond to the disclosure. Operators of Wavlink WL-WN578W2 firmware 221110 should treat the device as unpatched and consider replacement with a supported product where feasible.
Workarounds
- Block inbound HTTP requests to /live_online.shtml at an upstream firewall or reverse proxy
- Enforce management-plane ACLs so only administrator hosts can reach the router's web interface
- Segment IoT and networking equipment onto isolated VLANs with no direct exposure to guest or WAN networks
- Retire and replace the device if it must be exposed to untrusted networks
# Example iptables rule to block external access to the vulnerable endpoint
# Applied on an upstream Linux gateway protecting the Wavlink device (192.0.2.10)
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 \
-m string --string "/live_online.shtml" --algo bm -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 \
! -s 10.10.10.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
