CVE-2026-3716
A vulnerability was determined in Wavlink WL-WN579X3-C 231124.
Does this matter?
Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a manipulation of the argument Hostname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 20260226 is able to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- CVSS 4.0
- 1.9 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-94
- Affected
- wavlink/wl-wn579x3-c firmware
- Source
- cna@vuldb.com
References
- https://dl.wavlink.com/firmware/RD/WN579X3C_WAVLINK_V20260226_WO_cb3003b2.binBroken Link
- https://github.com/Litengzheng/vul_db/blob/main/WL-WN579X3-C/vul_18/README.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.349661Permissions Required, VDB Entry
- https://vuldb.com/?id.349661Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.765326Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.