CVE-2026-4164 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: March 16, 2026
Wavlink WL-WN578W2 - Command Injection
Overview
Wavlink WL-WN578W2 221110 contains a command injection caused by manipulation in Delete_Mac_list/SetName/GuestWifi functions in /cgi-bin/wireless.cgi POST Request Handler, letting remote attackers execute arbitrary commands, exploit requires crafted POST request.
Severity & Score
Impact
Remote attackers can execute arbitrary commands, potentially taking full control of the device.
Mitigation
Upgrade to the latest version of the affected component.
References
- https://vuldb.com/?ctiid.351071
- https://vuldb.com/?id.351071
- https://vuldb.com/?submit.768292
- https://vuldb.com/?submit.768293
- https://vuldb.com/?submit.768294
- https://dl.wavlink.com/firmware/RD/WINSTAR_WN578W2-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
- https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_1/README.md
- https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_2/README.md
Social Media Activity(2 posts)
š“ CVE-2026-4164 - Critical (9.8) A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is p... š https://www.thehackerwire.com/vulnerability/CVE-2026-4164/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2026-4164 - Critical (9.8) A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is p... š https://www.thehackerwire.com/vulnerability/CVE-2026-4164/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-4164
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- command_injection
- Status
- unconfirmed
- EPSS
- 16.7%
- Social Posts
- 2
CWE
- CWE-74
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H