Description
A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

An attacker can manipulate HTTP POST parameters dmz_flag or del_flag in the /cgi-bin/firewall.cgi endpoint of the Wavlink WL‑WN578W2 firmware version 221110. This flaw allows arbitrary system command execution on the device, resulting in complete takeover of the router’s operating system.

Affected Systems

Wavlink WL‑WN578W2 routers running firmware build 221110 are affected. No other Wavlink models or firmware releases are mentioned in the advisory.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is rated moderate, yet remote execution of arbitrary code makes it valuable to attackers. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the public nature of the exploit code and the lack of a vendor patch mean that any device exposed to the internet remains at significant risk.

Generated by OpenCVE AI on March 22, 2026 at 11:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Wavlink that resolves the command injection flaw.
  • If a firmware update is not yet available, block or restrict external POST access to the /cgi-bin/firewall.cgi endpoint using the router’s firewall or a reverse proxy.
  • Disable remote management interfaces on the router and restrict management to the local network or a dedicated management VLAN.
  • Monitor HTTP logs for suspicious POST requests to /cgi-bin/firewall.cgi and consider alerting on anomalous patterns.

Generated by OpenCVE AI on March 22, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wavlink wl-wn578w2
Vendors & Products Wavlink wl-wn578w2

Sun, 22 Mar 2026 09:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Wavlink WL-WN578W2 POST Request firewall.cgi command injection
First Time appeared Wavlink
Wavlink wl-wn578w2 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:wavlink:wl-wn578w2_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn578w2 Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wl-wn578w2 Wl-wn578w2 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-23T16:22:35.195Z

Reserved: 2026-03-21T15:23:43.128Z

Link: CVE-2026-4543

cve-icon Vulnrichment

Updated: 2026-03-23T16:22:30.808Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-22T10:16:07.200

Modified: 2026-03-23T14:31:37.267

Link: CVE-2026-4543

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:46:33Z

Weaknesses