EUVD-2026-12192Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend POST request to /cgi-bin/wireless.cgi
-
ExploitInject shell commands in SetName/GuestWifi parameter
-
ExecutionExecute arbitrary commands as root
-
ImpactAchieve full device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default Wavlink WL-WN579A3 220323 routers with wireless.cgi endpoint accessible on network. |
| Impact | This vulnerability presents extremely high real-world risk based on multiple indicators: The CVSS 9.8 score reflects network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and high impact across all CIA triads. The exploit is confirmed as public (E:P) with proof-of-concept code available on GitHub. While not currently in CISA KEV, the combination of unauthenticated remote access, public exploit availability, and the typical internet exposure of wireless routers makes this a critical priority. The attack is fully automatable with no user interaction required (UI:N), making mass exploitation feasible. This is a genuine high-priority vulnerability, not just a theoretical high-CVSS issue. |
| Exploit ScenarioDerived | An attacker can remotely exploit this vulnerability without any authentication by sending a malicious POST request to the vulnerable /cgi-bin/wireless.cgi endpoint. By injecting shell commands into the SetName or GuestWifi parameters, the attacker gains command execution on the device. This could lead to complete device compromise, including modifying DNS settings, intercepting traffic, using the device as a pivot point for lateral movement, or incorporating it into a botnet. The public POC at https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_10/README.md demonstrates the attack methodology, making exploitation trivial for even unsophisticated attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical command injection vulnerability in Wavlink WL-WN579A3 wireless router firmware version 220323, allowing unauthenticated remote attackers to execute arbitrary commands via the SetName/GuestWifi functions in /cgi-bin/wireless.cgi. A public proof-of-concept exploit is available, and while a vendor patch exists, the vulnerability has not yet been added to CISA's KEV catalog despite its high severity (CVSS 9.8).
RemediationAI
Immediate patching is strongly recommended. Wavlink has released a patched firmware version dated 2026-03-10 (build 94f93d4) available at: https://dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin. As a temporary mitigation, restrict access to the device's web interface to trusted networks only and disable remote management features if possible. Monitor for suspicious POST requests to /cgi-bin/wireless.cgi, particularly those targeting SetName or GuestWifi functions.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Wavlink WL-WN579A3 wireless access point/router (CPE: cpe:2.3:a:wavlink:wl-wn579a3:*:*:*:*:*:*:*:*). It stems from improper input validation in the POST request handler, specifically in the SetName and GuestWifi functions within the /cgi-bin/wireless.cgi script. This is a classic command injection vulnerability (CWE-77), where user-supplied input is passed to system commands without proper sanitization, allowing attackers to inject arbitrary OS commands that execute with the privileges of the web server process.
Know when Wl Wn579a3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.
Executive ViewAI
A critical remote command injection vulnerability affects Wavlink WL-WN579A3 wireless devices with a public exploit now available. Any organization using this device model faces immediate risk of unauthorized system access and network compromise. This requires urgent patching to prevent exploitation.
Apply vendor patch. If patching is delayed: (1) Disable guest WiFi functionality via device admin interface; (2) Restrict network access from wireless devices to critical systems using network segmentation and firewall rules; (3) Monitor /cgi-bin/wireless.cgi requests for command injection patterns; (4) Implement network access control (NAC) to limit device connectivity; (5) Consider temporary device shutdown if not essential to operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB