| Titre | WAVLINK Multiple Router Series (WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc.) WN529, WN530, WN531, WN535, WN536, WN551, WN557, NU516,and so on Stack-based Buffer Overflow |
|---|
| Description | Attachment password: yuanshenqidong
Attachment password: yuanshenqidong
Attachment password: yuanshenqidong
Attachment password: yuanshenqidong
Attachment password: yuanshenqidong
firmware download:https://docs.wavlink.xyz/Firmware/
WAVLINK multiple router series are affected by the same stack-based
buffer overflow in upload.cgi, allowing unauthenticated remote code
execution across all affected devices.
Through cross-series firmware reverse engineering, the following series
were confirmed to share the identical vulnerable upload.cgi code path
(strcpy of HTTP_COOKIE with no bounds check):
WN572 Series (WL-WN572HP3-A, WL-WN572HP3-B, WL-WN572HE4, WL-WN572HE4D)
WN570H Series (WL-WN570HA1B, WL-WN570HA2, WL-WN570HN2B)
WN573 Series
WN529 Series (WL-WN529E4, WL-WN529E4-D)
WN530 Series (WL-WN530BE1-A, WL-WN530BE2-A, WL-WN530H4-A, WL-WN530HG4B)
WN531 Series (WL-WN531E4D, WL-WN531P3)
WN535 Series (WL-WN535M1)
And additional series
Rather than exhaustively exploit every model, two representative devices
were selected for full ROP chain verification, proving the cross-series
exploitability:
1) WL-WN572HP3-A (MIPS32 LE, libc base 0x2AAAB000):
ROP chain writes "/usr/sbin/telnetd -p999 -l /bin/sh" to libc BSS
via STORE gadget, then calls system() to spawn a reverse shell.
2) WN570H (MIPS32 LE, libc base 0x2AB6A000):
Ultra-compact 4-hop ROP chain calling execve("/bin/sh") directly.
Both devices have ASLR disabled (randomize_va_space=0), making libc
gadget addresses fixed and predictable. All remaining series share the
same exploitation methodology — only per-device libc gadget offsets
need adjustment.
Internet exposure confirmed via FOFA/Shodan/ZoomEye queries.
No authentication is required. |
|---|
| La source | ⚠️ https://github.com/0xcc12138/WAVLINK-vul |
|---|
| Utilisateur | 0xcc12138 (UID 97530) |
|---|
| Soumission | 09/06/2026 08:19 (il y a 2 mois) |
|---|
| Modérer | 03/08/2026 09:17 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 385530 [Wavlink NU516 jusqu’à 20260609 lighttpd upload.cgi strcpy HTTP_COOKIE buffer overflow] |
|---|
| Points | 20 |
|---|