0Xcc12138

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

A flaw in the `/cgi-bin/adm.cgi` endpoint allows remote OS command injection. The issue occurs when the `lan ip` argument is manipulated, as the value is stored unfiltered and subsequently executed via a second request. This stored injection is further facilitated by weak Cross-Site Request Forgery (CSRF) and Referer checks, potentially allowing attacks to be launched from malicious websites. Exploitation can lead to DNS hijacking, Man-in-the-Middle (MITM) attacks, and lateral movement within the local area network. The vulnerability specifically affects the `wlink uci set value()` function.

A flaw in the API Endpoint component allows for remote OS command injection. This occurs through the manipulation of the `destination` argument within the function system of the '/cgi-bin/mbox-config?section=ping config' endpoint.

A remote buffer overflow exists in the HNAP Service component within the '/web/cgi-bin/hnap/hnap service' file. The issue occurs during the processing of the `SetDeviceSettings()` function when the `AdminPassword` argument is manipulated. This flaw allows attackers to execute arbitrary code remotely.