CVE-2026-2528: Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection
A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function DeleteMaclist of the file /cgi-bin/wireless.cgi. The manipulation of the argument deletelist leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2528?
CVE-2026-2528 has been classified as a high-severity command injection vulnerability.
How do I fix CVE-2026-2528?
To fix CVE-2026-2528, update the Wavlink WL-WN579A3 firmware to a version released after 20210219.
What systems are affected by CVE-2026-2528?
CVE-2026-2528 affects the Wavlink WL-WN579A3 model up to version 20210219.
What type of vulnerability is CVE-2026-2528?
CVE-2026-2528 is a command injection vulnerability found in the Delete_Mac_list function.
Can CVE-2026-2528 be exploited remotely?
Yes, CVE-2026-2528 can be exploited remotely due to improper validation of user inputs.