EUVD-2026-12204Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend POST request to /cgi-bin/wireless.cgi
-
ExploitInject OS commands in Delete_Mac_list/SetName/GuestWifi parameters
-
ExecutionExecute arbitrary commands on router
-
ImpactAchieve full system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Wavlink WL-WN578W2 firmware version 221110 with /cgi-bin/wireless.cgi endpoint accessible. No authentication required. Exploitable against default installations with web interface exposed to network. |
| Impact | This represents a critical real-world risk based on multiple indicators: CVSS 9.8 indicates network-accessible (AV:N) with low complexity (AC:L) requiring no authentication (PR:N) or user interaction (UI:N), resulting in complete system compromise (C:H/I:H/A:H). The existence of a public POC (E:P) significantly increases exploitation likelihood. While not currently in CISA KEV and lacking EPSS data, the combination of unauthenticated remote code execution, public exploit code, and widespread deployment of home routers makes this a priority for immediate patching. This is a textbook example of high CVSS correlating with high real-world risk. |
| Exploit ScenarioDerived | An attacker can remotely exploit this vulnerability without any authentication by sending malicious POST requests to the affected CGI script. For example, targeting the Delete_Mac_list function with command injection payloads in the MAC address parameter could allow execution of arbitrary commands. The public POC available at https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/ demonstrates practical exploitation. Given the low complexity and network accessibility, automated scanning and exploitation at scale is feasible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Critical command injection vulnerability in Wavlink WL-WN578W2 wireless routers (firmware version 221110) that allows unauthenticated remote attackers to execute arbitrary commands via specially crafted POST requests to multiple functions in the wireless.cgi script. A public proof-of-concept exploit is available on GitHub, and the vendor has released a patch, making this a high-priority issue for immediate remediation despite no current KEV listing.
RemediationAI
Immediately update to the patched firmware version available at: https://dl.wavlink.com/firmware/RD/WINSTAR_WN578W2-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin. If immediate patching is not possible, consider implementing network segmentation to limit access to the management interface, use strong firewall rules to restrict access to trusted IP addresses only, and monitor for suspicious POST requests to /cgi-bin/wireless.cgi.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Wavlink WL-WN578W2 wireless router (CPE: cpe:2.3:a:wavlink:wl-wn578w2:*:*:*:*:*:*:*:*), specifically in the POST request handler component at /cgi-bin/wireless.cgi. Multiple functions are vulnerable including Delete_Mac_list, SetName, and GuestWifi. This is a classic command injection vulnerability (CWE-77) where user-supplied input is passed to system commands without proper sanitization, allowing attackers to inject shell metacharacters and execute arbitrary commands on the underlying operating system.
Know when Wl Wn578w2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component.
Executive ViewAI
A critical remote code execution vulnerability affects Wavlink WL-WN578W2 wireless devices with a published exploit actively available. Any organization using this device model faces immediate risk of unauthorized system access and network compromise without remediation.
Apply vendor patch. If immediate patching is unavailable: disable remote management access to affected devices, implement network segmentation to restrict access to administrative interfaces, deploy WAF rules to block POST requests to /cgi-bin/wireless.cgi with suspicious parameters, and monitor for exploitation attempts targeting Delete_Mac_list, SetName, and GuestWifi functions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Wl Wn578w2
View allWavlink WL-WN578W2 routers contain a command injection vulnerability in the /cgi-bin/firewall.cgi POST handler that allo
A Stored/Reflected Cross-Site Scripting (XSS) vulnerability exists in the Wavlink WL-WN578W2 wireless router (firmware v
Exploit-DB