Description
A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component.
Published: 2026-03-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Command Injection
Action: Update Firmware
AI Analysis

Impact

A flaw has been found in the Delete_Mac_list, SetName, and GuestWifi functions of /cgi-bin/wireless.cgi on the Wavlink WL‑WN578W2. The vulnerability allows an attacker to inject arbitrary shell commands via a crafted POST request. This results in remote command execution with the privileges of the web service process. The weakness corresponds to CWE‑74 (Untrusted Input to a Command Processor) and CWE‑77 (Improper Limitation of a Command).

Affected Systems

The issue affects Wavlink WL‑WN578W2 routers running the 221110 firmware build. Only devices that expose the /cgi-bin/wireless.cgi endpoint with the GuestWifi functionality are vulnerable, as described in the vendor’s documentation.

Risk and Exploitability

The CVSS base score is 9.3, classifying the vulnerability as critical. EPSS is below 1 %, indicating a low current exploitation probability, yet an exploit has been published and is available. The vulnerability is not listed in the CISA KEV catalog. The vendor confirms that the attack can be launched remotely via a POST request to /cgi-bin/wireless.cgi without prior authentication.

Generated by OpenCVE AI on March 17, 2026 at 17:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to the latest version available from Wavlink
  • Disable the GuestWifi feature if it is not required
  • Restrict external access to the /cgi-bin/wireless.cgi endpoint using firewall rules or VPN
  • Monitor device logs for suspicious POST requests to wireless.cgi

Generated by OpenCVE AI on March 17, 2026 at 17:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Wavlink wl-wn578w2
Vendors & Products Wavlink wl-wn578w2

Sun, 15 Mar 2026 03:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component.
Title Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection
First Time appeared Wavlink
Wavlink wl-wn578w2 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:wavlink:wl-wn578w2_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn578w2 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wl-wn578w2 Wl-wn578w2 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-17T13:42:57.181Z

Reserved: 2026-03-14T12:21:53.308Z

Link: CVE-2026-4164

cve-icon Vulnrichment

Updated: 2026-03-17T13:42:53.112Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-16T14:19:55.380

Modified: 2026-03-16T14:53:07.390

Link: CVE-2026-4164

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:02:04Z

Weaknesses