Wavlink WL-WN570HA1 CVE-2026-7692

Q: What is the CVSS score of CVE-2026-7692?

CVE-2026-7692 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-26831 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-03 cna@vuldb.com

Command Injection Wl Wn570Ha1 Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 03, 2026 - 11:30 vuln.today

EUVD ID Assigned

May 03, 2026 - 11:22 euvd

EUVD-2026-26831

Analysis Generated

May 03, 2026 - 11:22 vuln.today

CVE Published

May 03, 2026 - 11:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. The affected element is the function ping_ddns of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument DDNS results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. Once again the vendors acted very professional and confirms, "that the WN570HA1 firmware version R70HA1 V1410_221110 has been removed from our website." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the DDNS argument in the ping_ddns function of /cgi-bin/adm.cgi. The vulnerability affects only unsupported end-of-life firmware that the vendor has removed from distribution; publicly available exploit code exists but real-world impact is limited due to end-of-support status and authentication requirement.

Technical ContextAI

The vulnerability exists in the CGI script /cgi-bin/adm.cgi, specifically in the ping_ddns function which handles Dynamic DNS (DDNS) configuration. The underlying flaw is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating insufficient input validation or sanitization of the DDNS parameter before it is passed to system command execution. The attack leverages the web-accessible CGI endpoint to inject shell metacharacters or commands that are executed with the privileges of the web service process. This is a classic case of command injection in embedded device firmware where user-supplied input is concatenated directly into system commands without proper escaping or parameterization.

RemediationAI

No vendor-released patch is available; the manufacturer's response was to remove the affected firmware version from distribution and discontinue support for the WL-WN570HA1 model. Organizations operating this device should immediately cease use and replace with a current, supported Wavlink model or alternative vendor equipment. If discontinuation is not feasible in the short term, implement network-level compensating controls: restrict access to the device's management interface (typically port 80/443) using firewall rules, IP whitelisting, or a VPN gateway-limit access to trusted administrative networks only. Disable remote management features if the device supports local-only configuration mode. Change default credentials and disable DDNS functionality if not required for operations. These controls reduce network accessibility (AV:N becomes AV:L effectively) but do not remediate the underlying vulnerability and should be considered temporary measures only. Any investment in these controls should be time-bounded pending device replacement.