Login Request a demo
Critical severity · published Mar 14, 2026
CVE-2026-4163
Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-WN579A3 · Wavlink
220323 · source: vendor
Affected product
WL
WL-WN579A3
Wavlink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4163
dl.wavlink.com
https://dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
github.com
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_10/README.md
github.com
https://github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_9/README.md
vuldb.com
https://vuldb.com/?ctiid.351070
vuldb.com
https://vuldb.com/?id.351070
vuldb.com
https://vuldb.com/?submit.765327
More from WL-WN579A3
9.8
CVE-2026-2529
Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection
9.8
CVE-2026-2528
Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection
9.8
CVE-2026-2527
Wavlink WL-WN579A3 login.cgi command injection
9.8
CVE-2025-44881
A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input
9.8
CVE-2025-44880
A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input