CVE-2026-2527

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-252706.7Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.CVE-2026-252717.0Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.CVE-2026-252726.7Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.CVE-2026-252736.7Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.CVE-2026-252746.7Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.CVE-2026-252757.5Transient DOS when processing authentication frames with invalid FILS information element header lengths.CVE-2026-252768.8Memory corruption while using Strongbox due to missing bounds check.CVE-2026-252778.8Memory corruption while using Strongbox due to buffer overflow.CVE-2026-252787.0Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.CVE-2026-25289.8A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the f CVE-2026-252807.8Memory corruption when processing escape handling flow with insufficient user buffer sizes.CVE-2026-252817.4Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.