Description
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-22
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Monitor
AI Analysis

Impact

The vulnerability resides in the POST request handler of /cgi-bin/login.cgi on Wavlink WL‑WN578W2 routers running firmware 221110. By altering the "homepage/hostname/login_page" parameter, an attacker can inject arbitrary JavaScript code, creating a client‑side cross‑site scripting flaw.

Affected Systems

Affected devices are Wavlink WL‑WN578W2 routers with firmware version 221110. No other variants are known to be impacted.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack can be launched remotely, implying that an adversary needs only network access to the router’s web interface to exploit the flaw. Currently no official patch has been released and the vendor has not responded to the disclosure.

Generated by OpenCVE AI on March 22, 2026 at 13:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an official firmware update from Wavlink when it becomes available.
  • Restrict access to the router’s web management interface to trusted internal networks only.
  • Disable remote management or restrict the IP addresses that can reach the web interface.
  • Configure a strong, unique password for the administrative account.

Generated by OpenCVE AI on March 22, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wavlink wl-wn578w2
Vendors & Products Wavlink wl-wn578w2

Sun, 22 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Wavlink WL-WN578W2 POST Request login.cgi cross site scripting
First Time appeared Wavlink
Wavlink wl-wn578w2 Firmware
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:o:wavlink:wl-wn578w2_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn578w2 Firmware
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wl-wn578w2 Wl-wn578w2 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-23T16:07:56.364Z

Reserved: 2026-03-21T15:23:59.764Z

Link: CVE-2026-4544

cve-icon Vulnrichment

Updated: 2026-03-23T16:07:52.230Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-22T10:16:07.560

Modified: 2026-03-23T14:31:37.267

Link: CVE-2026-4544

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:46:32Z

Weaknesses