PT-2026-8306 · Wavlink · Wavlink Wl-Wn579A3

Kdb3169 · Published 2026-01-28 · Updated 2026-02-18 · CVE-2026-2530

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN579A3 versions up to 20210219

Description A flaw exists in Wavlink WL-WN579A3 that allows for remote command injection. The issue is located in the AddMac function within the /cgi-bin/wireless.cgi file. Manipulation of the macAddr argument can lead to command execution. The exploit code has been publicly released. The vendor was notified but did not respond.

Recommendations Versions up to 20210219 should be updated when a fix becomes available. As a temporary workaround, restrict access to the /cgi-bin/wireless.cgi file. Avoid using the macAddr parameter until the issue is resolved.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2026-02349

CVE-2026-2530

Affected Products

Wavlink Wl-Wn579A3

References · 11

• 🔥 https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/AddMac.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-2530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2530 · Security Note
• https://bdu.fstec.ru/vul/2026-02349 · Security Note
• https://vuldb.com/?ctiid.346118 · Note
• https://vuldb.com/?id.346118 · Note
• https://t.me/cveNotify/152080 · Telegram Post
• https://twitter.com/CVEarity/status/2023304516935057515 · Twitter Post
• https://twitter.com/SecAideInfo/status/2024071038250930294 · Twitter Post
• https://vuldb.com/?submit.748077 · Note
• https://t.me/CVEtracker/44785 · Telegram Post