CVE-2026-4164: Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-16 · updated 2026-06-17
Weakness: CWE-74

Description

A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component.

Affected products

Wavlink WL-WN578W2: 221110

References

https://dl.wavlink.com/firmware/RD/WINSTAR_WN578W2-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_1/README.md
https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_2/README.md
https://vuldb.com/?ctiid.351071
https://vuldb.com/?id.351071
https://vuldb.com/?submit.768292
https://vuldb.com/?submit.768293
https://vuldb.com/?submit.768294

Get alerted when CVE-2026-4164 or the next vulnerability affects your stack