Wl Wn579a3 CVE-2026-6559

Exploitation requires the following concrete conditions: (1) network-reachable access to the router's web management interface (typically port 80 or 443 from the WAN or LAN, depending on router configuration); (2) the router must be running an affected firmware version prior to 2026-03-10 build; (3) a victim with administrative access to the router (typically the router owner or network administrator) must visit the login page after the payload has been injected and stored in the device configuration; (4) JavaScript execution must be enabled in the victim's browser (default behavior for all modern browsers). The vulnerability does NOT require authentication to submit the malicious Hostname parameter initially (PR:N), allowing unauthenticated remote attackers to inject payloads. However, exploitation is LIMITED by the requirement that a victim must then visit the login interface - the attacker cannot directly execute code or retrieve data without user interaction. Additionally, if the router's web interface is restricted to LAN-only access (a common admin practice), attack surface is reduced to local network attackers only.

CVSS 4.3 (low-to-moderate) reflects the limited immediate impact: no confidentiality loss, only integrity impact (I:L), and attack vector is network but requires user interaction (UI:R). The CVSS vector shows no privilege escalation (PR:N), meaning unauthenticated remote access is possible. However, the UI:R flag significantly reduces real-world risk - the attacker cannot unilaterally execute code without a victim (likely the router administrator) visiting a malicious site or being socially engineered to reload the login page. Attack complexity is low (AC:L), meaning no special conditions are required beyond network access. The stored nature of this XSS (payload persists in device configuration) elevates risk compared to reflected XSS, as every subsequent admin login to the web interface will trigger the payload. EPSS data not provided, but typical stored XSS in router admin interfaces scores 15-25% exploitation probability due to the UI:R requirement and need for admin interaction. This is a real priority for router administrators but not a critical remote code execution risk. No active exploitation (KEV status) or public POC has been confirmed at time of analysis, though the GitHub reference suggests researcher disclosure.

An attacker crafts a malicious URL containing JavaScript payload in the Hostname parameter (e.g., http://target-router/cgi-bin/login.cgi?hostname=<script>steal-cookies()</script>) and tricks a router administrator into clicking the link or hosts the payload on a compromised website that the admin visits. When the administrator's browser processes the login page, the injected script executes in the context of the router's web interface, potentially stealing session cookies, credentials, or redirecting the admin to a phishing page to capture new credentials. Since the payload is stored, subsequent admin logins automatically trigger the attack without additional user interaction beyond routine login.