Description
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-03
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Title Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
First Time appeared Wavlink
Wavlink etc. Wn529
Wavlink nu516
Wavlink wn529
Wavlink wn530
Wavlink wn531
Wavlink wn535
Wavlink wn536
Wavlink wn551
Wavlink wn557
Wavlink wn570h
Wavlink wn572
Wavlink wn573
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:nu516:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn557:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:*
cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink etc. Wn529
Wavlink nu516
Wavlink wn529
Wavlink wn530
Wavlink wn531
Wavlink wn535
Wavlink wn536
Wavlink wn551
Wavlink wn557
Wavlink wn570h
Wavlink wn572
Wavlink wn573
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T20:23:24.093Z

Reserved: 2026-08-03T07:17:39.882Z

Link: CVE-2026-18607

cve-icon Vulnrichment

Updated: 2026-08-03T20:23:18.871Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow