EUVD-2026-14297
GHSA-jg8g-rwpf-2m3j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A Stored/Reflected Cross-Site Scripting (XSS) vulnerability exists in the Wavlink WL-WN578W2 wireless router (firmware version 221110 and potentially others) within the POST request handler of /cgi-bin/login.cgi. An attacker with high privileges can manipulate the homepage, hostname, or login_page parameters to inject malicious JavaScript that executes in the context of other users' browsers. A proof-of-concept has been publicly disclosed on GitHub, and the vendor has not responded to early disclosure notifications, leaving affected devices unpatched.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), indicating insufficient input validation and output encoding in the login.cgi component. The Wavlink WL-WN578W2 (identified via CPE cpe:2.3:a:wavlink:wl-wn578w2) is a wireless router that processes user-supplied parameters (homepage, hostname, login_page) in POST requests to /cgi-bin/login.cgi without properly sanitizing or HTML-encoding them before rendering them in HTTP responses. This allows an attacker to break out of the intended HTML context and inject arbitrary script tags that execute with the privileges of the authenticated session.
RemediationAI
No official patch is available from Wavlink at this time due to the vendor's lack of response to disclosure. Immediate mitigation steps include: (1) Restrict administrative access to the router's web interface by implementing network-level access controls (firewall rules limiting access to trusted subnets only); (2) Disable web management of the device if not actively required, or enforce access via a VPN; (3) Change default admin credentials to strong, unique passwords and avoid reusing credentials across multiple routers; (4) Consider replacing the affected router with a model from a vendor with an active security response program. Monitor Wavlink's support channels and VulDB (https://vuldb.com/?id.352361) for any future security updates. For organizations managing multiple WL-WN578W2 devices, document the vulnerability in your asset inventory and escalate to procurement to plan hardware replacement.
More in Wl Wn578w2
View allCritical command injection vulnerability in Wavlink WL-WN578W2 wireless routers (firmware version 221110) that allows un
Wavlink WL-WN578W2 routers contain a command injection vulnerability in the /cgi-bin/firewall.cgi POST handler that allo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today