The vulnerability resides in the AddMac command of /cgi-bin/wireless.cgi on the Wavlink WL-WN579A3 router. By manipulating the macAddr argument, an attacker can inject arbitrary shell commands, leading to remote execution of code on the device. Because the flaw is reachable from the network side, remote attackers with network access to the router’s web interface can exploit it without requiring local credentials.

The affected product is the Wavlink WL-WN579A3 wireless router. All firmware releases up to the 20210219 build are vulnerable. No other vendors or versions are impacted.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, the flaw enables remote code execution and the exploit code is publicly available. The vendor did not respond to disclosure, so no official patch exists at present.