Wavlink WL-WN570HA1 EUVD-2026-26829

Exploitation requires valid administrative credentials to authenticate to the web interface (PR:L in CVSS vector). The attack targets the set_sys_adm function specifically in /cgi-bin/adm.cgi, which must be accessible on the network. The Username parameter must accept and pass unsanitized input to a system command - this is the specific vulnerable code path. Exploitation is limited to the privilege level of the web server process (typically non-root on properly configured systems), meaning full system compromise depends on the application running with elevated privileges. The vulnerability does NOT require user interaction, special configurations beyond default deployment, or exploitation of a specific application feature - it exists in the administrative interface by default. Limiting factors include requirement for prior authentication and potential OS-level restrictions on command execution scope.

Despite the low CVSS score of 2.1, this vulnerability presents moderate real-world risk within its constrained scope. The CVSS vector indicates network accessibility (AV:N) with low attack complexity (AC:L), but requires authenticated access (PR:L), substantially limiting the attack surface compared to unauthenticated exploits. The presence of publicly available exploit code (E:P) elevates practical risk for organizations still operating this end-of-life hardware. However, the low confidentiality, integrity, and availability impact scores (VC:L/VI:L/VA:L) reflect limited scope - command execution may be restricted by the web server process privileges. The critical limitation is that this firmware version is no longer supported and has been delisted by the vendor, meaning most active deployments should have migrated away. Organizations still running this specific firmware version face risk only if internal network access allows legitimate user credentials to be obtained or if default credentials remain unchanged. The mismatch between network vector and authentication requirement suggests this is best classified as a lateral movement risk rather than a primary attack vector.

An attacker with valid administrative credentials (or obtained via credential compromise or default credentials) authenticates to the WL-WN570HA1 web interface and submits a specially crafted POST request to /cgi-bin/adm.cgi with the set_sys_adm function, injecting OS commands into the Username parameter (e.g., Username=admin;cat%20/etc/passwd). The unvalidated input is executed by the device, allowing the attacker to read sensitive files, modify configurations, or establish persistence on the network device.