0Xcc12138

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-NU516U1 version 260515 **Description** A flaw in the `/cgi-bin/adm.cgi` endpoint allows remote OS command injection. The issue occurs when the `lan ip` argument is manipulated, as the value is stored unfiltered and subsequently executed via a second request. This stored injection is further facilitated by weak Cross-Site Request Forgery (CSRF) and Referer checks, potentially allowing attacks to be launched from malicious websites. Exploitation can lead to DNS hijacking, Man-in-the-Middle (MITM) attacks, and lateral movement within the local area network. The vulnerability specifically affects the `wlink uci set value()` function. **Recommendations** Update Wavlink WL-NU516U1 version 260515 to the fixed firmware version released by the vendor.

**Name of the Vulnerable Software and Affected Versions** Comfast CF-WR631AX V3 versions prior to 2.7.0.8 **Description** A flaw in the API Endpoint component allows for remote OS command injection. This occurs through the manipulation of the `destination` argument within the function system of the '/cgi-bin/mbox-config?section=ping config' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DCS-935L versions prior to 1.10.01 **Description** A remote buffer overflow exists in the HNAP Service component within the '/web/cgi-bin/hnap/hnap service' file. The issue occurs during the processing of the `SetDeviceSettings()` function when the `AdminPassword` argument is manipulated. This flaw allows attackers to execute arbitrary code remotely. **Recommendations** Update to a version later than 1.10.01. As a temporary workaround, disable the HNAP Service to minimize the risk of exploitation.