Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
Priority HIGH 73CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00792 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wavlink | WN572 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN570H | 20260609 | — | No fix listed | CNA |
| Wavlink | WN573 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN529 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN530 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN531 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN535 | 20260609 | — | No fix listed | CNA |
| Wavlink | etc. WN529 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN530 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN531 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN535 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN536 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN551 | 20260609 | — | No fix listed | CNA |
| Wavlink | WN557 | 20260609 | — | No fix listed | CNA |
| Wavlink | NU516 | 20260609 | — | No fix listed | CNA |
- WN572 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN570H VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN573 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN529 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN530 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN531 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN535 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- etc. WN529 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN530 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN531 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN535 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN536 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN551 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- WN557 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
- NU516 VendorWavlink Affected 20260609 Fixed in — No fix listed CNA
CPE names CNA · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:* | — | — | Wavlink |
| cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:* | — | — | Wavlink |
- cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:* Versions — — ·Wavlink
- cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:* Versions — — ·Wavlink
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18607
- 2026-10-03 Alias added: GHSA-82rw-j2xw-2766
References
More Wavlink vulnerabilities
- TI-2022-02298 WAVLINK WN535K2/WN535K3 nightled.cgi os command injection CVSS 3.1CRITICAL 9.8
- TI-2026-83752 OS command injection in WAVLINK WN551X3-A DNS resolution handler CVSS 4.0CRITICAL 10.0
- TI-2026-83751 WAVLINK WN551X3-A WireGuard CLI Group ioos os command injection CVSS 4.0CRITICAL 10.0
- TI-2026-83668 Stack-based overflow in WAVLINK WN536AX6-A OpenVPN handler CVSS 4.0CRITICAL 10.0
- TI-2026-83667 OS command injection in WAVLINK WN536AX6-A WireGuard handler CVSS 4.0CRITICAL 10.0
- TI-2026-83666 OS command injection in WAVLINK WN536AX6-A openvpn_cli handler CVSS 4.0CRITICAL 10.0
Sources
- CVE-2026-18607 · CVE Program
- CVE-2026-18607 · NVD
- FIRST EPSS
- GHSA-82rw-j2xw-2766 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences