CVE-2026-4543

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-454307.1The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow agaCVE-2026-454318.7This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its webCVE-2026-454328.7This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management inCVE-2026-454338.7This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote CVE-2026-454349.8Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects ApCVE-2026-454356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-BCVE-2026-454366.5Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.CVE-2026-454377.1Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-454387.5Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control SecurCVE-2026-454399.3Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45444.8A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the componenCVE-2026-454407.6Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.