The vulnerability lies in the Initial Setup Wizard’s adm.cgi, where the set_wzdgwMesh function accepts an argument wlan_ssid and uses it in a system call without proper validation. This flaw allows an attacker to inject arbitrary OS commands, giving them full control over the device’s operating system. The impact is severe, potentially enabling the attacker to modify settings, run malicious code, or compromise the network. The weakness is a classic OS command injection (CWE-77) compounded by improper handling of user-supplied data (CWE-78).

This issue affects the WAVLINK WL‑WN579A3‑A router, firmware identified as 2026‑03‑10‑94f93d4. The affected element is the adm.cgi component of the Initial Setup Wizard, specifically the set_wzdgwMesh routine. Only the listed model and firmware version exhibit the flaw; no other WAVLINK models or versions are known to be impacted.

The CVSS score of 10 indicates critical severity. The EPSS score is not available, but the public disclosure and the presence of a known exploit raise the likelihood of real‑world attacks. The vulnerability is not in the CISA KEV catalog, yet its remote nature and full system access move it into the highest risk tier. Attackers can reach the vulnerable endpoint over the network, conduct the injection remotely, and execute arbitrary commands on the device with the privileges of the web process. This combination of high severity, ease of exploitation, and full administrative control creates a maximal threat to both individual devices and networks that rely on them.