CVE-2025-34044 Details
Description
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-25 UTC.
A remote command injection vulnerability has been identified in the WIFISKY 7-layer Flow Control Router. This vulnerability exists in the confirm.php interface, where insufficient input validation allows unauthenticated attackers to execute arbitrary operating system commands. The issue can be exploited by sending a specially crafted HTTP GET request that targets the 't' parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2025CISA-ADP
Assessed Jun 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/wifisky7-rce.yaml | [email protected] | Exploit |
| https://s4e.io/tools/wifisky-7-layer-flow-control-router-remote-code-execution | [email protected] | ExploitTechnical Description |
| https://vulncheck.com/advisories/wifisky-flow-control-router-rce | [email protected] | AdvisoryBroken Link |
| https://www.cnvd.org.cn/flaw/show/CNVD-2021-45363 | [email protected] | AdvisoryPartial Content |
| https://www.variotdbs.pl/vuln/VAR-202107-1715/ | [email protected] | AdvisoryNot Applicable |
| http://www.szwifisky.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shenzhen Airspace Technology WIFISKY 7-layer Flow Control Router | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 17, 2025 | CVE Modified | [email protected] |
| Jun 26, 2025 | New CVE Received | [email protected] |