Vulnerability · Published Mar 14, 2026 · Assigned by VulDB

CVE-2026-4163Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

Critical 9.8

In plain English

A critical-severity command injection in WL-WN579A3 from Wavlink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.2%top 17.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.

Affected products (as reported)

Vendor	Product	Versions
Wavlink	WL-WN579A3	220323

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References

VDB-351070 | Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection vdb-entry, technical-description
VDB-351070 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #765327 | Wavlink WL-WN579A3 V220323 Command Injection third-party-advisory
Submit #765328 | Wavlink WL-WN579A3 V220323 Command Injection (Duplicate) third-party-advisory
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_9/README.md related
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_10/README.md exploit
https://dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin patch