CVE-2026-3716: Wavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scripting
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub401AD4 of the file /cgi-bin/adm.cgi. Executing a manipulation of the argument Hostname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 20260226 is able to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3716?
CVE-2026-3716 is considered a high severity vulnerability due to its ability to allow cross site scripting attacks.
How do I fix CVE-2026-3716?
To fix CVE-2026-3716, users should update the Wavlink WL-WN579X3-C to the latest firmware version available from the vendor.
Who is affected by CVE-2026-3716?
CVE-2026-3716 affects all Wavlink WL-WN579X3-C devices running firmware version 231124 or earlier.
Can CVE-2026-3716 be exploited remotely?
Yes, CVE-2026-3716 can be exploited remotely, making it critical for affected users to implement fixes quickly.
What type of attack does CVE-2026-3716 enable?
CVE-2026-3716 enables cross site scripting (XSS) attacks through the manipulation of the Hostname argument.