Wavlink WN-series CVE-2026-18607

The attack targets the upload.cgi CGI endpoint served by lighttpd on Wavlink routers. The specific prerequisite is that the attacker must supply a valid authenticated HTTP session (satisfying PR:L per the CVSS 4.0 vector) - this is typically a session cookie obtained after logging in with valid credentials, including default factory credentials that are frequently unchanged on consumer devices. The vulnerable code path is triggered by sending an HTTP request with an oversized HTTP_COOKIE header to upload.cgi; no special router feature or non-default configuration is required beyond the management HTTP interface being reachable. Exploitation is limited by: (1) the need to satisfy PR:L authentication (default credentials or prior credential compromise required); (2) network reachability to the lighttpd HTTP management port (typically TCP 80 or 8080); and (3) the device being one of the affected models running firmware through 20260609. WAN-side exposure of the management interface, which is non-default on many consumer routers but common in misconfigured deployments, would allow remote internet exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4, with E:P (exploit maturity: proof-of-concept) reflecting the publicly disclosed PoC on GitHub. PR:L indicates that some level of authentication is required - likely a valid session cookie - which moderately constrains unauthenticated mass exploitation. Attack complexity is low and requires no user interaction, meaning that once credentials are obtained (via default credentials, credential stuffing, or session fixation), exploitation is straightforward and automatable. No EPSS data was supplied; however, the combination of network reachability, low complexity, high impact, and public PoC suggests elevated real-world exploitation probability relative to the 7.4 base score alone. The absence of a CISA KEV listing suggests no confirmed mass exploitation campaign at time of analysis, but Wavlink devices are frequently exposed directly to the internet and targeted by IoT botnets. The primary mitigating factor is PR:L - attackers must first obtain a valid session.

An attacker with low-privilege access to the Wavlink management interface - obtained via default credentials or a brute-force attempt - sends a crafted HTTP request to upload.cgi with an oversized HTTP_COOKIE header value. The unsafe strcpy call overflows the stack buffer, overwrites the return address, and redirects execution to shellcode or a ROP chain embedded in the cookie payload. Given the absence of robust exploit mitigations on embedded Wavlink firmware, an attacker achieves root-level code execution on the router, enabling persistent backdoor installation or lateral movement into the LAN. A public PoC on GitHub reduces the skill required to execute this attack.