EUVD-2026-52371
GHSA-82rw-j2xw-2766
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector confirmed; PR:L because CVSS 4.0 source vector specifies low privilege and session authentication is required to reach upload.cgi.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
Technical ContextAI
The vulnerability resides in upload.cgi, a CGI handler executed under lighttpd (a lightweight HTTP server commonly embedded in MIPS/ARM-based SOHO router firmware). The root cause is CWE-121 (Stack-Based Buffer Overflow): the function strcpy is used to copy the attacker-controlled HTTP_COOKIE header value into a statically allocated stack buffer, with no bounds checking. Because the return address and saved frame pointer reside on the same stack frame, a sufficiently long cookie string overwrites the return address, redirecting execution to attacker-controlled code. On embedded Linux systems like these routers, exploit mitigations such as stack canaries, ASLR, and NX are frequently absent or weakly implemented, making return-address overwrites straightforward. Affected CPE strings span cpe:2.3:a:wavlink:wn529 through wn573 and wn572, confirming the vulnerability is present across the shared firmware codebase used by multiple device SKUs.
RemediationAI
No vendor-released patch has been identified at time of analysis; affected firmware versions run up to 20260609 with no confirmed fixed release in the reference data. Administrators should immediately disable remote (WAN-side) management access to the HTTP interface on all affected Wavlink models, as this eliminates the network attack surface for unauthenticated and low-privilege attackers reaching upload.cgi from outside the LAN. On LAN-exposed deployments, restrict HTTP management access using firewall rules or VLAN segmentation to trusted management hosts only, accepting the trade-off of reduced administrative flexibility. Changing default credentials reduces the risk of an attacker satisfying the PR:L requirement, though it does not eliminate the vulnerability. Monitor the vendor's firmware update page and apply any patch addressing upload.cgi or the lighttpd HTTP_COOKIE handling immediately upon release. The public PoC is available at https://github.com/0xcc12138/WAVLINK-vul and should be used to validate remediation effectiveness in lab environments prior to production deployment.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today