The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device.
References
| Link | Resource |
|---|---|
| https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63218_Axel%20Technology%20WOLF1MS%20and%20WOLF2MS%20-%20Broken%20Access%20Control | Exploit Third Party Advisory |
| https://www.axeltechnology.com/ | Product |
Configurations
History
12 Jan 2026, 16:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63218_Axel%20Technology%20WOLF1MS%20and%20WOLF2MS%20-%20Broken%20Access%20Control - Exploit, Third Party Advisory | |
| References | () https://www.axeltechnology.com/ - Product | |
| First Time |
Axeltechnology wolf1ms
Axeltechnology wolf2ms Axeltechnology wolf2ms Firmware Axeltechnology wolf1ms Firmware Axeltechnology |
|
| CPE | cpe:2.3:o:axeltechnology:wolf2ms_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:axeltechnology:wolf1ms:-:*:*:*:*:*:*:* cpe:2.3:h:axeltechnology:wolf2ms:-:*:*:*:*:*:*:* cpe:2.3:o:axeltechnology:wolf1ms_firmware:*:*:*:*:*:*:*:* |
19 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-285 CWE-284 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
19 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-19 15:15
Updated : 2026-01-12 16:01
NVD link : CVE-2025-63218
Mitre link : CVE-2025-63218
CVE.ORG link : CVE-2025-63218
JSON object : View
Products Affected
axeltechnology
- wolf2ms
- wolf1ms_firmware
- wolf1ms
- wolf2ms_firmware