CVE-2026-2529

Summary

A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

Weaknesses

• CWE-77: Command Injection
• CWE-74: Injection

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://vuldb.com/?id.346117
• https://vuldb.com/?ctiid.346117
• https://vuldb.com/?submit.748076
• https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/DeleteMac.md

• ←Previous
• Next→