CVE-2026-18607 in WN572
Summary
by MITRE • 08/03/2026
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability affects multiple Wavlink wireless networking devices including WN572, WN570H, WN573, and various other models up to firmware version 20260609. The issue resides in the lighttpd web server component within the device's firmware, specifically in the file upload.cgi script where the strcpy function is improperly utilized. The vulnerability stems from inadequate input validation of the HTTP_COOKIE header parameter, creating a stack-based buffer overflow condition that can be exploited through remote network access.
The technical flaw manifests when an attacker crafts a malicious HTTP_COOKIE value that exceeds the allocated buffer space within the strcpy function call. This buffer overflow occurs because the implementation does not properly check the length of the incoming cookie data before copying it to a fixed-size stack buffer. According to CWE-121, this represents a classic stack-based buffer overflow vulnerability where insufficient bounds checking allows arbitrary data to overwrite adjacent memory locations. The attack vector is particularly concerning as it enables remote code execution without requiring physical access or authentication credentials.
The operational impact of this vulnerability is severe given the widespread deployment of these networking devices in both residential and commercial environments. An attacker could potentially execute arbitrary code on the affected devices, leading to complete system compromise including unauthorized network access, data exfiltration, or the installation of persistent backdoors. The public disclosure of exploitation techniques further amplifies the risk as attackers can readily weaponize this vulnerability against unpatched systems. This aligns with ATT&CK technique T1210 which describes exploitation of remote services for privilege escalation and system compromise.
Mitigation strategies should include immediate firmware updates from Wavlink to address the buffer overflow in the lighttpd component, particularly targeting the file upload.cgi script where the strcpy function is vulnerable. Network administrators should implement strict firewall rules to limit access to the affected web interfaces and consider segmenting network traffic to reduce potential attack surface. Additionally, monitoring for anomalous HTTP_COOKIE values and implementing intrusion detection systems can help identify exploitation attempts. Organizations should also conduct thorough inventory assessments to identify all affected devices and establish a patch management process to ensure timely remediation of similar vulnerabilities in other networking equipment.