Resources
/
Advisories
/
Authentication Bypass via Blank Credentials in Waveshare RS232/485 TO WIFI ETH (B)

IoT & Hardware

Authentication & Access Bypass

Authentication Bypass via Blank Credentials in Waveshare RS232/485 TO WIFI ETH (B)

Unauthenticated attackers can fully control the device, alter network settings, and upload firmware.

9.8
/ 10
Critical
CVSS v3.1
ADVISORY ID
PS91
PUBLISHED
2025-11-12
CVE IDs
CVE-2025-63362
VENDORS
Waveshare Electronics
PUBLIC EXPLOIT
PoC public
CWE
CWE-620
PRODUCT
RS232/485 TO WIFI ETH (B)
CVSS VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Abstract blurred background with dark tones and smooth gradient waves of blue, purple, and orange hues.
Summary

Overview

Improper Authentication / Authentication Bypass:

Improper Authentication / Authentication Bypass :Device allows Administrator username and password to be set to blank values, disabling authentication on Web and Telnet interfaces.

The CGI handler /EN/do_cmd.html fails to validate the admuser and SYSPS parameters.

If both are left blank, the authentication check is bypassed, granting unauthenticated administrative access.

Vulnerability details

Vulnerability details

CVE-2025-63362
CWE-620
Critical | 9.8

Improper Authentication / Authentication Bypass: Improper Authentication / Authentication Bypass :Device allows Administrator username and password to be set to blank values, disabling authentication on Web and Telnet interfaces.

Auth:
None (remote)
Impact:
Sensitive data disclosure, arbitrary data or code modification, denial of service
Impact

What an attacker can do

Unauthenticated attackers can fully control the device, alter network settings, and upload firmware.

DISCLOSURE

Disclosure timeline

2025-09-16 Initial report sent via Waveshare support portal with full disclosure report.

2025-09-23 Vendor acknowledged receipt.

2025-09-23 Researcher requested remediation timeline, CVD process, and CVE coordination details.

2025-09-24 Vendor replied: "Information received; feedback will be taken into account in future research."

2025-09-24 Researcher requested confirmation on CVD process and timeline.

2025-09-27 Vendor responded: "No specific timeline can be provided; security feedback will be considered in subsequent products."

2025-09-27 Researcher informed

References

2026-06-17 (NVD record)

Credits

Abhishek Pandey – Payatu Security Consulting Pvt. Ltd.

Related Advisories

jscript.dll - ActiveXObject BSTR - Use After Free

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-787
2022-09-27
High
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
IoT text with radio waves icon, symbolizing Internet of Things technology.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability

Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe…
Desktop Software
Memory Corruption
CWE-125
2022-10-01
Medium
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
IoT text with radio waves icon, symbolizing Internet of Things technology.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Opera Mini Location Permission Spoof

Opera Mini Location Permission Spoof Vulnerability A location permission spoof vulnerability was discovered in opera mini 47.1.2249.129326 for Android which allows an attacker to spoof location…
Browser
Spoofing
2022-10-01
Medium
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
IoT text with radio waves icon, symbolizing Internet of Things technology.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

Concerned about a similar issue in your product?

Payatu's researchers find these vulnerabilities before attackers do. Talk to us about product, firmware and IoT security testing.

Talk to an Expert
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
Explore our research
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
This is the default text value
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.