CVE-2026-6559

The vulnerability is a reflected cross-site scripting (XSS) issue in the Wavlink WL-WN579A3 router firmware version 220323. The flaw resides in the file /cgi-bin/login.cgi, specifically in the function sub_401F80. The Hostname parameter from a POST request is directly concatenated into the response without proper sanitization, allowing an attacker to inject arbitrary HTML or JavaScript [1].

Exploitation requires sending a crafted POST request to /cgi-bin/login.cgi with a malicious Hostname value. For example, setting Hostname to 192.168.6.2"<svg/onload=alert()> triggers the XSS. The attack is remote and does not require authentication, as the login.cgi endpoint is accessible to unauthenticated users [1].

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, or further attacks against the router's web interface. The XSS is triggered when the response is rendered, and the injected script runs with the privileges of the logged-in user [1].

The vendor was contacted and released a fixed firmware version. Users are strongly advised to upgrade to the latest firmware available from Wavlink's official website to mitigate this vulnerability [1].