CVE-2026-7692
MEDIUMWavlink WL-WN570HA1 adm.cgi ping_ddns command injection
Title source: cnaDescription
A vulnerability was detected in Wavlink WL-WN570HA1 R70HA1 V1410_221110. The affected element is the function ping_ddns of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument DDNS results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. Once again the vendors acted very professional and confirms, "that the WN570HA1 firmware version R70HA1 V1410_221110 has been removed from our website." This vulnerability only affects products that are no longer supported by the maintainer.
References (4)
Core 4
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-360862 | Wavlink WL-WN570HA1 adm.cgi ping_ddns command injection
https://vuldb.com/vuln/360862
Signature, Permissions Required signature
permissions-required
VDB-360862 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/360862/cti
Third Party Advisory third-party-advisory
Submit #807807 | Wavlink WN570HA1 WL-WN570HA1 221110 Command Injection
https://vuldb.com/submit/807807
Scores
CVSS v3
6.3
EPSS
0.0171
EPSS Percentile
82.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-74
CWE-77
Status
published
Products (2)
Wavlink/WL-WN570HA1
R70HA1 V1410_221110
wavlink/wl-wn570ha1_firmware
r70ha1_v1410_221110
Published
May 03, 2026
Tracked Since
May 03, 2026