Login Request a demo
Medium severity · published Mar 22, 2026
CVE-2026-4544
Wavlink WL-WN578W2 POST Request login.cgi cross site scripting
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-WN578W2 · Wavlink
221110 · source: vendor
WF
Wl-wn578w2 Firmware · Wavlink
221110 · source: NVD
Affected product
WL
WL-WN578W2
Wavlink
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4544
Exploit
https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_6/README.md
Exploit
https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_7/README.md
Permissions Required
https://vuldb.com/?ctiid.352361
Third Party Advisory
https://vuldb.com/?id.352361
Third Party Advisory
https://vuldb.com/?submit.774692
Third Party Advisory
https://vuldb.com/?submit.774693
More from WL-WN578W2
9.8
CVE-2026-4164
Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection
9.8
CVE-2025-10359
Wavlink WL-WN578W2 wireless.cgi sub_404DBC os command injection
9.8
CVE-2025-10358
Wavlink WL-WN578W2 wireless.cgi sub_404850 os command injection
9.8
CVE-2025-10324
Wavlink WL-WN578W2 firewall.cgi sub_401C5C command injection
9.8
CVE-2025-10323
Wavlink WL-WN578W2 wizard_rep.shtml sub_409184 command injection