CVE-2026-18607

Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

State: Published
Severity: 8.7 High
Published: Aug 3, 2026
Updated: Aug 3, 2026
Reserved: Aug 3, 2026

Description

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-121 Stack-based Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
WN572Wavlink	20260609Affected
WN570HWavlink	20260609Affected
WN573Wavlink	20260609Affected
WN529Wavlink	20260609Affected
WN530Wavlink	20260609Affected
WN531Wavlink	20260609Affected
WN535Wavlink	20260609Affected
etc. WN529Wavlink	20260609Affected
WN530Wavlink	20260609Affected
WN531Wavlink	20260609Affected
WN535Wavlink	20260609Affected
WN536Wavlink	20260609Affected
WN551Wavlink	20260609Affected
WN557Wavlink	20260609Affected
NU516Wavlink	20260609Affected

References

VDB-385530 | Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflowvdb-entrytechnical-description
VDB-385530 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-18607 | CVE Analysis and Reportthird-party-advisory
Submit #852637 | WAVLINK Multiple Router Series (WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc.) WN529, WN530, WN531, WN535, WN536, WN551, WN557, NU516,and so on Stack-based Buffer Overflowthird-party-advisory
https://github.com/0xcc12138/WAVLINK-vulexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.