PT-2026-8302 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2528

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A command injection issue exists in the function

Delete Mac list

of the file

/cgi-bin/wireless.cgi

. Manipulation of the

delete list

argument can lead to command injection. Remote exploitation is possible. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Apply updates to versions after 20210219. As a temporary workaround, restrict access to the

/cgi-bin/wireless.cgi

file. Avoid using the

delete list

argument in the

/cgi-bin/wireless.cgi

endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-2528

Affected Products

Wavlink Wl-Wn579A3

References · 8

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/Delete_Mac_list.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2528 · Security Note
• https://vuldb.com/?id.346116 · Note
• https://twitter.com/VulmonFeeds/status/2023229354738663531 · Twitter Post
• https://twitter.com/CVEarity/status/2023298957720584327 · Twitter Post
• https://t.me/cveNotify/152078 · Telegram Post
• https://vuldb.com/?submit.748075 · Note
• https://vuldb.com/?ctiid.346116 · Note