CVE-2026-4544: Wavlink WL-WN578W2 POST Request login.cgi cross site scripting
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/loginpage can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4544?
CVE-2026-4544 has a medium severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2026-4544?
To fix CVE-2026-4544, update the Wavlink WL-WN578W2 router to the latest firmware version that addresses this vulnerability.
What type of vulnerability is CVE-2026-4544?
CVE-2026-4544 is a cross-site scripting (XSS) vulnerability affecting the login.cgi file in Wavlink WL-WN578W2 routers.
Who is affected by CVE-2026-4544?
Users of the Wavlink WL-WN578W2 model with firmware version 221110 are affected by CVE-2026-4544.
Can CVE-2026-4544 lead to data theft?
Yes, if exploited, CVE-2026-4544 could allow attackers to steal user credentials or session tokens.