CVE-2026-2526: Wavlink WL-WN579A3 wireless.cgi multi_ssid command injection
A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multissid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2526?
CVE-2026-2526 is a high severity vulnerability due to potential command injection in the Wavlink WL-WN579A3 device.
How do I fix CVE-2026-2526?
To fix CVE-2026-2526, update the Wavlink WL-WN579A3 firmware to a version released after February 19, 2021.
What impacts are associated with CVE-2026-2526?
CVE-2026-2526 can allow an attacker to execute arbitrary commands on the Wavlink WL-WN579A3 through the multi_ssid function.
Which devices are affected by CVE-2026-2526?
CVE-2026-2526 specifically affects the Wavlink WL-WN579A3 device up to firmware version 20210219.
Is CVE-2026-2526 exploitable remotely?
Yes, CVE-2026-2526 can be exploited remotely, making it critical to secure the affected devices.