PT-2026-33617 · Wavlink · Wl-Wn579A3

Ltzhust2 · Published 2026-04-18 · Updated 2026-04-19 · CVE-2026-6559

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 version 220323

Description A cross site scripting issue exists in the function sub 401F80() within the '/cgi-bin/login.cgi' file. This occurs due to the improper manipulation of the Hostname argument, allowing for remote exploitation.

Recommendations Upgrade the affected component to the fixed version released by the vendor.

Fix

XSS

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-79

CWE-94

CWE-74

Related Identifiers

BDU:2026-05628

CVE-2026-6559

Affected Products

Wl-Wn579A3

References · 12

• https://dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6559 · Security Note
• https://bdu.fstec.ru/vul/2026-05628 · Security Note
• https://vuldb.com/vuln/358196 · Note
• https://wavlink.com/en_us/index.html · Note
• https://vuldb.com/vuln/358196/cti · Note
• https://twitter.com/infoflowcloud/status/2045836781963137286 · Twitter Post
• https://twitter.com/CVEnew/status/2045835243555307566 · Twitter Post
• https://vuldb.com/submit/785303 · Note
• https://cve.report/CVE-2026-6559 · Note
• ❌ https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_16/README.md · Note, Deleted
• https://twitter.com/VulmonFeeds/status/2045752397780177206 · Twitter Post