PT-2026-8302 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Published 2026-02-15 · Updated 2026-02-18 · CVE-2026-2528

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A command injection issue exists in the function Delete Mac list of the file /cgi-bin/wireless.cgi. Manipulation of the delete list argument can lead to command injection. Remote exploitation is possible. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Apply updates to versions after 20210219. As a temporary workaround, restrict access to the /cgi-bin/wireless.cgi file. Avoid using the delete list argument in the /cgi-bin/wireless.cgi endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2026-02019

CVE-2026-2528

Affected Products

Wavlink Wl-Wn579A3

References · 12

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/Delete_Mac_list.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-2528 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02019 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2528 · Security Note
• https://t.me/cveNotify/152078 · Telegram Post
• https://vuldb.com/?id.346116 · Note
• https://twitter.com/VulmonFeeds/status/2023229354738663531 · Twitter Post
• https://vuldb.com/?submit.748075 · Note
• https://twitter.com/CVEarity/status/2023298957720584327 · Twitter Post
• https://t.me/CVEtracker/44783 · Telegram Post
• https://vuldb.com/?ctiid.346116 · Note
• https://twitter.com/SecAideInfo/status/2024071056760373388 · Twitter Post