CVE-2026-7690 is a medium severity (CVSS 6.3) command injection in the set_sys_adm function of Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110. The product is no longer supported and the vendor has removed the firmware. Replace the device, or isolate it from untrusted networks.
What's affected
- Product: Wavlink WL-WN570HA1 range extender, firmware R70HA1 V1410_221110.
- Affected: that firmware, through the
set_sys_admfunction of/cgi-bin/adm.cgi, where the Username argument is passed unsafely. - Fixed: none. The record quotes the vendor saying this firmware version has been removed from its website, and that the product is no longer supported.
- Weakness: CWE-74 and CWE-77, injection and command injection.
- CVSS 6.3 (medium), published 2026-05-03. The record says an exploit has been made public. Not listed in CISA KEV.
How to check if you're exposed
Find the device and its firmware version. Log in to the admin page of the extender, and read the firmware version on the status or system page. Compare it with R70HA1 V1410_221110.
Also check whether the admin interface is reachable from anywhere other than your trusted network. Scan your own network ranges for hosts with that web interface, and make sure it is not forwarded from the internet.
What to do now
- List WL-WN570HA1 devices on your networks, including ones in remote offices and homes.
- Replace them with a supported model, since the vendor has dropped the firmware and will not patch it.
- Until replaced, put them on a separate network segment, and block access to the admin interface except from a single admin host.
- Change the admin password to a unique one, and turn off remote management.
- Check the device for odd settings, and reset it to defaults before you decommission it.
Why it matters
The record points to the Username argument as the way in. User controlled text reaches a shell command, which is what command injection means. The attack can be started remotely, which is why the admin interface should not be exposed.
End of support is the larger issue. With no patch coming, the only fixes are replacement and network controls. Keep an inventory of unsupported network gear and set a date to retire it.
Quick check
Is a patch coming?
The record quotes the vendor saying the firmware was removed from its website and that the product is no longer supported. Plan for replacement.
Sources
- VulDB entry 360860 (page did not load usable content)
- Researcher write-up listed in the record (did not load)
Last reviewed: 19 October 2026.
