CVE-2026-2528 is a command injection flaw in the Wavlink WL-WN579A3 router firmware up to 20210219, in the Delete_Mac_list function of /cgi-bin/wireless.cgi. NVD scores it 6.3. The advisory says the vendor did not respond to the disclosure, so no fixed firmware is known. Treat the device as exposed and limit access.
What's affected
- Product: Wavlink WL-WN579A3 and its firmware, up to the 20210219 build.
- Location: the Delete_Mac_list function of /cgi-bin/wireless.cgi, argument delete_list.
- Fixed version: none is stated. The vendor did not respond to the researcher, so check Wavlink's support page for any newer firmware.
- Public exploit details: NVD says the exploit has been publicly disclosed.
How to check if you're exposed
Log in to the router's admin page and note the firmware build date in the status page. If it is 20210219 or older, assume it is affected. From inside your network you can also check whether the management interface answers on a WAN address or an exposed port:
nmap -p 80,443,8080 YOUR.WAN.IP.ADDRESS
Run that only against equipment you own.
What to do now
- Turn off remote administration and make sure the web interface is not reachable from the internet.
- Limit access to the admin interface to a single trusted management host or VLAN.
- Change the admin password and do not reuse it elsewhere.
- Check Wavlink's support site for newer firmware and apply it if it exists.
- If no fix appears, plan to replace the device, since an unpatched router sits in front of everything else you own.
Why it matters
The record classes this as CWE-74 and CWE-77: input from a request is passed into a command that the device runs, without being neutralised. On a router that runs as a privileged user, that can mean control of the device.
The CVSS vector lists low privileges required, so the score is moderate and an attacker is expected to hold a login. That should not comfort anyone who has left a default password in place. There is no CISA KEV entry for this CVE.
Quick check
Does MAC filtering on this router stay safe to use?
The flaw is in the code that edits the MAC list, so treat the management interface as the risk and keep it away from untrusted networks, whether or not you use MAC filtering.
Sources
Last reviewed: 19 October 2026.
