CVE-2026-2528
Published: 16 February 2026
Summary
CVE-2026-2528 is a medium-severity Injection (CWE-74) vulnerability in Wavlink Wl-Wn579A3 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates information input validation mechanisms at CGI entry points to neutralize special elements in the delete_list argument, directly preventing command injection.
Requires timely identification, reporting, prioritization, and correction of flaws like this command injection vulnerability in the router firmware.
Enables monitoring of system activity to detect anomalous access or exploitation attempts against the vulnerable wireless.cgi endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router web CGI script directly enables exploitation of public-facing application (T1190), remote services (T1210), and arbitrary command execution on network device (T1059.008).
NVD Description
A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection. Remote exploitation of the attack is possible. The…
more
exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-2528 is a command injection vulnerability affecting the Wavlink WL-WN579A3 router firmware up to version 20210219. The issue resides in the Delete_Mac_list function within the /cgi-bin/wireless.cgi script, where the delete_list argument can be manipulated to inject arbitrary commands. This flaw, classified under CWE-74 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Command Injection), carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating medium severity with network accessibility and low attack complexity.
An attacker with low privileges, such as an authenticated user on the device, can remotely exploit this vulnerability over the network without user interaction. Successful exploitation allows limited impacts: low-level disclosure of confidential information, modification of data or settings, and denial of service through partial availability disruption, all within the unchanged scope of the affected component.
Advisories from VulDB note that the vendor was contacted early regarding disclosure but provided no response, implying no official patches or mitigations are available. A proof-of-concept exploit is publicly available on GitHub at https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/Delete_Mac_list.md, increasing the risk of active use.
Security practitioners should isolate or decommission affected Wavlink WL-WN579A3 devices, monitor for anomalous wireless.cgi access, and apply network segmentation to limit low-privilege remote access until firmware updates emerge.
Details
- CWE(s)