CVE-2026-2526

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-252607.0Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.CVE-2026-252617.8Memory corruption while processing rear sensor IOCTL calls.CVE-2026-252626.3Memory corruption while processing a crafted ELF file in the Primary Bootloader.CVE-2026-252636.6Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.CVE-2026-252648.8Privilege escalation due to weak configuration during package extraction process.CVE-2026-252658.8Privilege escalation due to weak configuration while temporary file handling.CVE-2026-252667.8Memory corruption while processing IOCTL command when device is in power-save state.CVE-2026-252677.8Memory corruption when non-secure loader rewrites page tables before secure memory initialization.CVE-2026-252688.8Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.CVE-2026-252696.7Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.CVE-2026-25279.8A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executi CVE-2026-252706.7Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.