The flaw resides in the DeleteMac function of wireless.cgi on Wavlink WL‑WN579A3 routers. By supplying specially crafted values to the delete_list parameter, an attacker can cause arbitrary shell commands to be executed on the device. Because the attack is triggered through the web interface, it can be performed without local access, granting the attacker full control over the affected router. The vulnerability is classified as a command injection (CWE‑74) and command injection in external input (CWE‑77).

The vulnerability affects Wavlink WL‑WN579A3 routers with firmware versions up to and including 20210219. All models shipping with the wireless.cgi file that implements the DeleteMac command are susceptible, including the specific hardware model identified by the vendor product list. No other models or firmware revisions are known to be impacted.

The CVSS base score is 5.3, denoting moderate severity, and the EPSS score is below 1%, indicating a low probability that the vulnerability will be actively exploited. The vulnerability is not listed in CISA’s KEV catalog, further suggesting no known large‑scale exploitation. Attackers would need to reach the router’s web interface, send a crafted request containing malicious delete_list data, and observe any resulting changes to confirm success. Because the command injection occurs through a remote HTTP endpoint, the attack vector is remote. No external prerequisites beyond web access and the ability to query the router’s CGI scripts are required.