CVE-2026-4543: Wavlink WL-WN578W2 POST Request firewall.cgi command injection
A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmzflag/delflag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4543?
CVE-2026-4543 is considered a critical vulnerability due to its potential for command injection.
How do I fix CVE-2026-4543?
To fix CVE-2026-4543, update the Wavlink WL-WN578W2 to the latest firmware version provided by Wavlink.
What type of attack does CVE-2026-4543 allow?
CVE-2026-4543 allows attackers to perform command injection through manipulated POST requests.
Which product is affected by CVE-2026-4543?
CVE-2026-4543 affects the Wavlink WL-WN578W2 router, specifically version 221110.
What components are involved in CVE-2026-4543?
CVE-2026-4543 involves the POST Request Handler within the firewall.cgi file.