Wavlink WL-WN570HA1 EUVD-2026-26830

Exploitation requires authenticated access to the web administration interface of the Wavlink WL-WN570HA1 device running firmware version R70HA1 V1410_221110 or potentially earlier revisions. The attacker must possess valid credentials (username and password) to the administrative interface. The set_sys_cmd function must be accessible via the /cgi-bin/adm.cgi endpoint, which is enabled by default. No additional special configuration or non-default settings are required beyond standard network connectivity to the device's web interface. Authentication is the primary limiting factor; unauthenticated remote exploitation is not possible with this vulnerability.

This vulnerability presents moderate real-world risk despite the CVSS 6.3 score. The CVSS vector indicates network accessibility with low complexity but requires authenticated access (PR:L), which limits the attack surface compared to unauthenticated flaws. However, multiple risk signals elevate concern: publicly available exploit code (E:P in vector), confirmed disclosure, and legacy/unsupported status means no vendor patch will be released. The lack of vendor support means affected installations cannot be patched and will remain vulnerable indefinitely. Organizations running this discontinued model require complete hardware replacement or network isolation. The CVSS score accurately reflects moderate severity - not critical due to authentication requirement, but significant because remediation is impossible through software updates.

An authenticated user with valid credentials to the WL-WN570HA1 web interface crafts a malicious HTTP request to /cgi-bin/adm.cgi with command injection payload in the command parameter (e.g., command=ping; cat /etc/passwd). The set_sys_cmd function executes the attacker's injected commands with device privileges, allowing data exfiltration, further system compromise, or lateral movement into the network the router serves.