Wavlink WN531P3 CVE-2026-74843

Exploitation requires network reachability to the device's lighttpd web server and the export_pingortrace.cgi endpoint, then sending a Cookie request header long enough to overflow the stack buffer processed by strcpy on HTTP_COOKIE - no authentication, user interaction, or non-default setting is required per the CVSS vector (PR:N/UI:N/AC:L). The primary limiting factor is exposure: on default deployments the admin web interface is LAN-facing, so an attacker must be on the local network or the router must have remote/WAN management enabled for Internet-based attacks. Affected scope is limited to WN531P3 and WN535M1 running firmware V250922.

The signals are largely consistent toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full high vulnerable-system impact, base 9.3) indicates trivial, unauthenticated, network-reachable exploitation, and a public PoC (E:P, exploit maturity Proof-of-Concept) is available. That said, real-world risk is tempered by exposure: these are consumer/SOHO devices whose web interface is usually LAN-facing, so mass Internet-wide exploitation depends on how many units expose the admin interface to the WAN. There is no EPSS score provided and no KEV listing, so exploitation to date appears opportunistic/theoretical rather than confirmed widespread. The vendor-supplied 4.0 vector also asserts subsequent-system impact (SC:H/SI:H/SA:H); this is likely overstated for a single-device compromise and should be treated with caution - device takeover is high, but cascading impact to other systems is not evidenced in the description.

An attacker who can reach the router's web interface (an on-LAN guest, a malicious device, or an Internet host if remote management is exposed) sends an HTTP request to export_pingortrace.cgi with an oversized, crafted Cookie header. The header overflows the stack buffer in the strcpy call, overwrites the return address, and executes attacker-supplied shellcode as root, granting full device takeover. A public PoC report demonstrating the buffer overflow is already available, lowering the barrier to weaponization.