PT-2026-8303 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Publicado 2026-01-28 · Atualizado 2026-02-18 · CVE-2026-2529

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A security flaw exists in Wavlink WL-WN579A3. The issue is due to command injection within the DeleteMac function located in the /cgi-bin/wireless.cgi file. Manipulation of the delete list argument can lead to remote code execution. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions up to 20210219 should be updated when a fix becomes available. As a temporary workaround, restrict access to the /cgi-bin/wireless.cgi file. Avoid manipulating the delete list argument.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2026-02350

CVE-2026-2529

Produtos afetados

Wavlink Wl-Wn579A3

Referências · 12

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/DeleteMac.md · Exploit
• https://vuldb.com/?id.346117 · Nota
• https://twitter.com/SecAideInfo/status/2024071046094266601 · Publicação no Twitter
• https://t.me/cveNotify/152079 · Publicação no Telegram
• https://twitter.com/CVEarity/status/2023301735931101349 · Publicação no Twitter
• https://vuldb.com/?submit.748076 · Nota
• https://twitter.com/VulmonFeeds/status/2023226794728439820 · Publicação no Twitter
• https://vuldb.com/?ctiid.346117 · Nota
• https://osv.dev/vulnerability/CVE-2026-2529 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-02350 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-2529 · Nota de Segurança
• https://t.me/CVEtracker/44784 · Publicação no Telegram