A stack-based buffer overflow occurs in the sub_40139C function of /cgi-bin/firewall.cgi after manipulating the del_flag argument. The flaw is a classic CWE-119 (Buffer Overflow) that can also trigger a stack corruption identified as CWE-121 (Stack Smashing). If successfully exploited, an adversary could execute arbitrary code on the device, or cause a denial of service by crashing the firewall service. The vulnerability is exposed through a remote request to the CGI interface, making it reachable from outside the local network.

The affected devices are Wavlink WL-WN579X3-C routers running firmware version 231124. The vendor released an updated firmware build, 20260226, that eliminates the flaw.

The CVSS score of 8.7 classifies this issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present but the flaw is publicly documented and remote in nature. The vulnerability is not listed in the CISA KEV catalog, but the existence of a public exploit means successful attacks are possible. A remote attacker could trigger the overflow by sending a specially crafted request to /cgi-bin/firewall.cgi with a tampered del_flag value, potentially gaining execution privileges on the device if the exploit payload takes advantage of the corrupted stack.