HIGH

CVE-2026-18607

2026-08-03 CVSS v3.1

CVSS

8.8

Description

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Weakness (CWE)

CWE-119 Memory Buffer Bounds Error

CWE-121 Stack-based Buffer Overflow

EPSS Score

0.44%

Probability of exploitation in next 30 days

37.5th percentile

References

https://github.com/0xcc12138/WAVLINK-vul https://vuldb.com/cve/CVE-2026-18607 https://vuldb.com/submit/852637 https://vuldb.com/vuln/385530 https://vuldb.com/vuln/385530/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE