EUVD-2026-60119
GHSA-p9ff-qq24-ccr6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable stack overflow (AV:N/AC:L/PR:N/UI:N) yielding root-level code execution on the device gives full C/I/A:H; scope unchanged as impact stays within the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
AnalysisAI
Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the device's lighttpd web server and the export_pingortrace.cgi endpoint, then sending a Cookie request header long enough to overflow the stack buffer processed by strcpy on HTTP_COOKIE - no authentication, user interaction, or non-default setting is required per the CVSS vector (PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full high vulnerable-system impact, base 9.3) indicates trivial, unauthenticated, network-reachable exploitation, and a public PoC (E:P, exploit maturity Proof-of-Concept) is available. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the router's web interface (an on-LAN guest, a malicious device, or an Internet host if remote management is exposed) sends an HTTP request to export_pingortrace.cgi with an oversized, crafted Cookie header. The header overflows the stack buffer in the strcpy call, overwrites the return address, and executes attacker-supplied shellcode as root, granting full device takeover. … |
| Remediation | No vendor-released patch identified at time of analysis - the disclosure notes the vendor was contacted early but does not cite a fixed firmware version, so monitor Wavlink's support site for a firmware update superseding V250922 and apply it once released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Wavlink WN531P3 and WN535M1 devices in your network infrastructure, implement firewall rules restricting access to the web interface (ports 80/443) to trusted administrative networks only, and disable remote management features if enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today