Wavlink WL-WN579A3 Wireless Router Remote Command Execution

Summary

A vulnerability in the Wavlink WL-WN579A3 router's wireless settings allows an attacker to remotely execute commands. This could lead to unauthorized access and potentially allow hackers to control the router. We recommend that users update their router firmware as soon as possible to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
wavlink	wl-wn579a3_firmware	<= 2021-02-19	–

Original title

A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of the argument macAddr causes command inj...

Original description

A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of the argument macAddr causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 6.5

nvd CVSS3.1 8.8

nvd CVSS4.0 5.3

Vulnerability type

CWE-74 Injection

CWE-77 Command Injection

https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/AddMac.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.346118 Permissions Required VDB Entry
https://vuldb.com/?id.346118 Third Party Advisory VDB Entry
https://vuldb.com/?submit.748077 Third Party Advisory VDB Entry