CVE-2026-4543

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is an unknown function of the file /cgi-bin/firewall.cgi of the component POST Request Handler. Performing a manipulation of the argument dmz_flag/del_flag results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Wavlink	WL-WN578W2	221110

References

https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_4/README.mdExploit, Third Party Advisory
https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_5/README.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.352360Permissions Required, VDB Entry
https://vuldb.com/?id.352360Third Party Advisory, VDB Entry
https://vuldb.com/?submit.774690Third Party Advisory, VDB Entry
https://vuldb.com/?submit.774691Third Party Advisory, VDB Entry

Timeline

Published: Mar 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-454307.1The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow aga CVE-2026-454318.7This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its web CVE-2026-454328.7This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management in CVE-2026-454338.7This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote CVE-2026-454349.8Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Ap CVE-2026-454356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-B CVE-2026-454366.5Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.CVE-2026-454377.1Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-454387.5Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-454399.3Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45444.8A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the componen CVE-2026-454407.6Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.