A command‑injection flaw exists in the /cgi-bin/login.cgi function of the Wavlink WL‑WN579A3 router. By manipulating the "key" argument in the CGI request, an attacker can execute arbitrary shell commands on the device. The vulnerability is an instance of CWE‑74 (Command Injection) and CWE‑77 (Command Injection). If exploited, the attacker would gain remote, privileged control over the router, potentially compromising network traffic and device configuration.

The flaw affects the Wavlink WL‑WN579A3 router, specifically firmware versions up to and including 20210219. The product is distributed as a consumer‑grade router and may be present in home or small business networks where the device is exposed to the internet.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is less than 1%, suggesting low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote network connectivity to the device and the ability to send a crafted HTTP request to the login CGI endpoint. No defense‑in‑depth controls are mentioned, so the attack path is straightforward once the target is reachable. The vendor has not released a patch, and the only publicly disclosed exploit is via an online repository.