PT-2026-36696 · Wavlink · Wl-Wn570Ha1

Wxhwxhwxh_Tutu · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7692

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN570HA1 version R70HA1 V1410 221110

Description A remote command injection issue exists in the ping ddns() function within the '/cgi-bin/adm.cgi' endpoint. Manipulating the DDNS argument allows an attacker to execute arbitrary commands on the system remotely.

Recommendations For version R70HA1 V1410 221110, as the firmware has been removed from the official website and the product is no longer supported, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-7692

Affected Products

Wl-Wn570Ha1

References · 8

• 🔥 https://lavender-bicycle-a5a.notion.site/Wavlink-WN570HA1-ping_ddns-34753a41781f80c0a6c6c1b09b7cdf1c?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7692 · Security Note
• https://t.me/cveNotify/161924 · Telegram Post
• https://vuldb.com/vuln/360862 · Note
• https://vuldb.com/submit/807807 · Note
• https://t.me/CVEtracker/52572 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2050906867430285460 · Twitter Post
• https://vuldb.com/vuln/360862/cti · Note