CVE-2026-4164 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: March 16, 2026
Wavlink WL-WN578W2 - Command Injection
Overview
Wavlink WL-WN578W2 221110 contains a command injection caused by manipulation in Delete_Mac_list/SetName/GuestWifi functions in /cgi-bin/wireless.cgi POST Request Handler, letting remote attackers execute arbitrary commands, exploit requires crafted POST request.
Severity & Score
Impact
Remote attackers can execute arbitrary commands, potentially taking full control of the device.
Mitigation
Upgrade to the latest version of the affected component.
References
- https://vuldb.com/?submit.768293
- https://vuldb.com/?submit.768294
- https://dl.wavlink.com/firmware/RD/WINSTAR_WN578W2-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
- https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_1/README.md
- https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_2/README.md
- https://vuldb.com/?ctiid.351071
- https://vuldb.com/?id.351071
- https://vuldb.com/?submit.768292
Social Media Activity(4 posts)
🚩 CVE-2026-4164 (CRITICAL): Wavlink WL-WN578W2 (221110) is vulnerable to remote command injection via POST to /cgi-bin/wireless.cgi. Public exploit is out. Restrict access, monitor logs, and upgrade ASAP. https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #IoTSecurity
View original post🚨 CVE-2026-4164 (CRITICAL, CVSS 9.3) in Wavlink WL-WN578W2 (v221110): Unauth'd command injection via /cgi-bin/wireless.cgi. Public exploit released. Patch ASAP or restrict access! https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #Infosec
View original post
🚩 CVE-2026-4164 (CRITICAL): Wavlink WL-WN578W2 (221110) is vulnerable to remote command injection via POST to /cgi-bin/wireless.cgi. Public exploit is out. Restrict access, monitor logs, and upgrade ASAP. https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #IoTSecurity
View original post🚨 CVE-2026-4164 (CRITICAL, CVSS 9.3) in Wavlink WL-WN578W2 (v221110): Unauth'd command injection via /cgi-bin/wireless.cgi. Public exploit released. Patch ASAP or restrict access! https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #Infosec
View original postRelated Resources
Details
- CVE ID
- CVE-2026-4164
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- command_injection
- Status
- unconfirmed
- EPSS
- 16.7%
- Social Posts
- 4
CWE
- CWE-74
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H