PT-2026-28722 · Wavlink · Wavlink Wl-Wn579X3-C

Ltzhuster2 + 1 · Published 2026-03-27 · Updated 2026-03-29 · CVE-2026-5004

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579X3-C version 231124

Description A stack-based buffer overflow exists in the UPNP Handler component of the Wavlink WL-WN579X3-C. The issue is located in the sub 4019FC function of the /cgi-bin/firewall.cgi file. Manipulation of the UpnpEnabled argument can trigger the overflow, allowing for remote attacks. The exploit has been publicly disclosed. The vendor was contacted but did not respond.

Recommendations Versions prior to 231124 should be updated. As a temporary workaround, consider disabling the UPNP functionality to minimize the risk of exploitation.

Exploit

Fix

Stack Overflow

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-787

CWE-119

Related Identifiers

CVE-2026-5004

Affected Products

Wavlink Wl-Wn579X3-C

References · 10

• 🔥 https://github.com/Litengzheng/vul_db/blob/main/WL-WN579X3-C/vul_200/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5004 · Security Note
• https://twitter.com/CveFindCom/status/2037948549111947449 · Twitter Post
• https://twitter.com/vuldb/status/2037532490404172182 · Twitter Post
• https://vuldb.com/submit/779149 · Note
• https://twitter.com/CVEnew/status/2038135168331063343 · Twitter Post
• https://vuldb.com/vuln/353891 · Note
• https://twitter.com/TheHackerWire/status/2037998101345210867 · Twitter Post
• https://vuldb.com/vuln/353891/cti · Note
• https://twitter.com/cyberbivash/status/2037966998311731581 · Twitter Post