CVE-2025-7882: Mercusys MW301R Login excessive authentication

Vulnerability summary

CVE-2025-7882 is a low (CVSS 3.1) vulnerability in mercusys mw301r. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-07-2025
   PublishedVulnerability first disclosed.
2. 21-07-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the component Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
• CWE-799Improper Control of Interaction FrequencyThe product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.