CVE-2026-4544

LOW

Wavlink WL-WN578W2 POST Request login.cgi cross site scripting

Title source: cna

Description

A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login_page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

References (7)

Core 7

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-352361 | Wavlink WL-WN578W2 POST Request login.cgi cross site scripting

https://vuldb.com/?id.352361

Signature, Permissions Required signature permissions-required

VDB-352361 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/?ctiid.352361

Third Party Advisory third-party-advisory

Submit #774692 | Wavlink WL-WN578W2 V221110 Cross Site Scripting

https://vuldb.com/?submit.774692

Third Party Advisory third-party-advisory

Submit #774693 | Wavlink WL-WN578W2 V221110 Cross Site Scripting (Duplicate)

https://vuldb.com/?submit.774693

Third Party Advisory third-party-advisory

Submit #774696 | Wavlink WL-WN578W2 V221110 Cross Site Scripting (Duplicate)

https://vuldb.com/?submit.774696

Related related

https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_6/README.md

View Writeup ZIP pw:eip

Exploit exploit

https://github.com/Litengzheng/vul_db/blob/main/WL-WN578W2/vul_7/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 2.4

EPSS 0.0026

EPSS Percentile 17.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (2)

Wavlink/WL-WN578W2 221110

wavlink/wl-wn578w2_firmware 221110

Published Mar 22, 2026

Tracked Since Mar 22, 2026