The vulnerability resides in the function sub_401AD4 of /cgi-bin/adm.cgi on the Wavlink WL‑WN579X3‑C router. By manipulating the Hostname argument, an attacker can inject arbitrary script code that is subsequently rendered in the web browser of anyone who accesses the adm.cgi page. The flaw is a traditional cross‑site scripting (XSS) flaw that can be triggered remotely without authentication, allowing an attacker to execute code in the victim’s browser, potentially logging credentials, defacing the web interface, or redirecting users to malicious sites.

The affected product is the Wavlink WL‑WN579X3‑C consumer router running firmware version 231124. The vendor has released a patch in firmware 20260226 that addresses the flaw; upgrading to that firmware version removes the vulnerability.

The CVSS score of 4.8 indicates a moderate severity, and an EPSS score of less than 1% suggests a low probability that an exploit is actively used in the wild. The flaw was publicly disclosed and can be exploited remotely from the internet, but since it relies on a browser‑based payload it requires an end‑user or administrator to open the malicious link. The vulnerability is not listed in the CISA KEV catalog, further indicating its exploitation risk is currently modest. Nevertheless, the remote nature of the attack vector and the broad impact of XSS justify prompt action.