Wl Wn579A3 A
Monthly
Unauthenticated OS command injection in the WAVLINK WL-WN579A3-A Initial Setup Wizard allows a remote attacker who can reach /cgi-bin/adm.cgi to execute arbitrary shell commands by supplying a crafted wlan_ssid argument to set_wzdgwMesh, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The issue affects the named 2026-03-10-94f93d4 firmware and is tracked as CWE-78; a public PoC reference exists, but it is not verified as working exploit code, and no CISA KEV confirmation was provided. Exposure is mainly limited by whether the device HTTP management interface is reachable from untrusted networks, and the priority label is act_now with no vendor-released patch identified at time of analysis.
Unauthenticated OS command injection in the WAVLINK WL-WN579A3-A Initial Setup Wizard allows a remote attacker who can reach /cgi-bin/adm.cgi to execute arbitrary shell commands by supplying a crafted wlan_ssid argument to set_wzdgwMesh, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The issue affects the named 2026-03-10-94f93d4 firmware and is tracked as CWE-78; a public PoC reference exists, but it is not verified as working exploit code, and no CISA KEV confirmation was provided. Exposure is mainly limited by whether the device HTTP management interface is reachable from untrusted networks, and the priority label is act_now with no vendor-released patch identified at time of analysis.