Cyber Posture

CVE-2026-2528

MediumPublic PoC

Published: 16 February 2026

Published
16 February 2026
Modified
18 February 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0041 61.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection. Remote exploitation of the attack is possible. The…

more

exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Mandates information input validation mechanisms at CGI entry points to neutralize special elements in the delete_list argument, directly preventing command injection.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, prioritization, and correction of flaws like this command injection vulnerability in the router firmware.

SI-4 System Monitoring partial match
detect

Enables monitoring of system activity to detect anomalous access or exploitation attempts against the vulnerable wireless.cgi endpoint.

Security SummaryAI

CVE-2026-2528 is a command injection vulnerability affecting the Wavlink WL-WN579A3 router firmware up to version 20210219. The issue resides in the Delete_Mac_list function within the /cgi-bin/wireless.cgi script, where the delete_list argument can be manipulated to inject arbitrary commands. This flaw, classified under CWE-74 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Command Injection), carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility and low attack complexity.

An attacker with low privileges, such as an authenticated user on the device, can remotely exploit this vulnerability over the network without user interaction. Successful exploitation allows limited impacts: low-level disclosure of confidential information, modification of data or settings, and denial of service through partial availability disruption, all within the unchanged scope of the affected component.

Advisories from VulDB note that the vendor was contacted early regarding disclosure but provided no response, implying no official patches or mitigations are available. A proof-of-concept exploit is publicly available on GitHub at https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/Delete_Mac_list.md, increasing the risk of active use.

Security practitioners should isolate or decommission affected Wavlink WL-WN579A3 devices, monitor for anomalous wireless.cgi access, and apply network segmentation to limit low-privilege remote access until firmware updates emerge.

Details

CWE(s)
CWE-74CWE-77

Affected Products

wavlink
wl-wn579a3 firmware
≤ 2021-02-19

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection in router web CGI script directly enables exploitation of public-facing application (T1190), remote services (T1210), and arbitrary command execution on network device (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References