PT-2026-8298 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2526

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A command injection issue exists in Wavlink WL-WN579A3. The issue is located in the

multi ssid

function within the

/cgi-bin/wireless.cgi

file. Manipulating the

SSID2G2

argument can lead to command injection. This attack can be initiated remotely. The exploit has been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 20210219 should be updated when a fix becomes available. As a temporary workaround, restrict access to the

/cgi-bin/wireless.cgi

file. Avoid manipulating the

SSID2G2

argument.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-2526

Affected Products

Wavlink Wl-Wn579A3

References · 8

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/multi_ssid.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2526 · Security Note
• https://t.me/cveNotify/152076 · Telegram Post
• https://vuldb.com/?ctiid.346114 · Note
• https://twitter.com/CVEarity/status/2023293400213225553 · Twitter Post
• https://vuldb.com/?submit.748073 · Note
• https://twitter.com/VulmonFeeds/status/2023234473404387549 · Twitter Post
• https://vuldb.com/?id.346114 · Note