Vulnerability · Published Jun 26, 2025 · Assigned by VulnCheck
CVE-2025-34044WIFISKY 7-Layer Flow Control Router Remote Command Execution
Critical 9.4
In plain English
A critical-severity OS command injection in WIFISKY 7-layer flow control router from Shenzhen Lingkong Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities).
Official description
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Lingkong Technology | WIFISKY 7-layer flow control router | 0 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- http://www.szwifisky.com/ product
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-45363 third-party-advisory
- https://s4e.io/tools/wifisky-7-layer-flow-control-router-remote-code-execution third-party-advisory
- https://www.variotdbs.pl/vuln/VAR-202107-1715/ third-party-advisory
- https://vulncheck.com/advisories/wifisky-flow-control-router-rce third-party-advisory
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/wifisky7-rce.yaml