PT-2026-8298 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Publicado 2026-02-15 · Atualizado 2026-02-18 · CVE-2026-2526

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A command injection issue exists in Wavlink WL-WN579A3. The issue is located in the multi ssid function within the /cgi-bin/wireless.cgi file. Manipulating the SSID2G2 argument can lead to command injection. This attack can be initiated remotely. The exploit has been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 20210219 should be updated when a fix becomes available. As a temporary workaround, restrict access to the /cgi-bin/wireless.cgi file. Avoid manipulating the SSID2G2 argument.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2026-02017

CVE-2026-2526

Produtos afetados

Wavlink Wl-Wn579A3

Referências · 12

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/multi_ssid.md · Exploit
• https://vuldb.com/?id.346114 · Nota
• https://twitter.com/CVEarity/status/2023293400213225553 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2526 · Nota de Segurança
• https://vuldb.com/?ctiid.346114 · Nota
• https://t.me/cveNotify/152076 · Publicação no Telegram
• https://t.me/CVEtracker/44779 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2026-02017 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2023234473404387549 · Publicação no Twitter
• https://twitter.com/SecAideInfo/status/2024071076666585517 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-2526 · Aviso do Fabricante
• https://vuldb.com/?submit.748073 · Nota