by Kastro
Paper/Archive/CVE-2026-4163

CVE-2026-4163

Wavlink WL-WN579A3 — Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.4.824 × 2016.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.

Affected

ProductAffectedFixed inSource
WL-WN579A3220323–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.351070refvuldb.com/?ctiid.351070writeupvuldb.com/?submit.765327writeupvuldb.com/?submit.765328refgithub.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_9/README.mdexploitgithub.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_10/README.mdpatchdl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin