An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirelessBasic) that do not enforce authentication. A remote unauthenticated attacker can modify WAN, LAN, and wireless settings directly, leading to privilege escalation and denial of service.
References
| Link | Resource |
|---|---|
| https://github.com/actuator/cve/blob/main/PandaWireless/CVE-2025-68715.txt | Third Party Advisory |
| https://github.com/actuator/cve/tree/main/PandaWireless | Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
History
30 Jan 2026, 01:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pandawireless pwru01 Firmware
Pandawireless Pandawireless pwru01 |
|
| CPE | cpe:2.3:h:pandawireless:pwru01:-:*:*:*:*:*:*:* cpe:2.3:o:pandawireless:pwru01_firmware:2.2.9:*:*:*:*:*:*:* |
|
| References | () https://github.com/actuator/cve/blob/main/PandaWireless/CVE-2025-68715.txt - Third Party Advisory | |
| References | () https://github.com/actuator/cve/tree/main/PandaWireless - Exploit |
09 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
08 Jan 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-08 20:15
Updated : 2026-01-30 01:04
NVD link : CVE-2025-68715
Mitre link : CVE-2025-68715
CVE.ORG link : CVE-2025-68715
JSON object : View
Products Affected
pandawireless
- pwru01
- pwru01_firmware
CWE
CWE-306
Missing Authentication for Critical Function