CVE-2026-4163: Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-16 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.

Affected products

Wavlink WL-WN579A3: 220323

References

https://dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_10/README.md
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_9/README.md
https://vuldb.com/?ctiid.351070
https://vuldb.com/?id.351070
https://vuldb.com/?submit.765327
https://vuldb.com/?submit.765328

Get alerted when CVE-2026-4163 or the next vulnerability affects your stack