CVE-2025-61128

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow vulnerability in WAVLINK QUANTUM D3G/WL-WN530HG3 firmware M30HG3_V240730, and possibly other wavlink models allows attackers to execute arbitrary code via crafted referrer value POST to login.cgi.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Oct 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-61138.8A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /CVE-2025-611327.1A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct passwor CVE-2025-611367.1A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct passw CVE-2025-611387.5Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.CVE-2025-61148.8A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_po CVE-2025-611409.8The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.CVE-2025-611417.5sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environme CVE-2025-611435.5libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.CVE-2025-611447.3libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.CVE-2025-611455.0libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.CVE-2025-611464.0saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.CVE-2025-611476.2strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(