CVE-2025-55847

HIGH

Wavlink M86X3A_V240730 - Buffer Overflow

Title source: llm

Description

Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service (DoS) on the system

References (1)

[Exploit, Third Party Advisory] https://github.com/meigui637/iot_zone/blob/main/%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E.md

View Exploit ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0006

EPSS Percentile 17.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-120

Status published

Affected Products (1)

wavlink/wl-wn586x3a_firmware

Timeline

Published Sep 26, 2025

Tracked Since Feb 18, 2026