Wavlink WL-WN578W2 POST Request login.cgi cross site scripting

Successful exploitation of CVE-2026-4544 allows an attacker to inject arbitrary JavaScript code into the web interface of the Wavlink WL-WN578W2 router. This can be leveraged to steal user cookies, redirect users to malicious websites, or even deface the router's login page. Given the router's role as a gateway to a home or small business network, a compromised router could serve as a launching point for further attacks against internal systems. The ability to execute code remotely significantly increases the potential impact, as attackers do not need physical access to the device.

Home and small business users relying on the Wavlink WL-WN578W2 router for network connectivity are at risk. Users who have not changed the default router configuration or have weak passwords are particularly vulnerable.

1. 2026-03-22Disclosure

   disclosure

1. Reserviert2026-03-21
2. Veröffentlicht2026-03-22
3. Geändert2026-03-23
4. EPSS aktualisiert2026-03-29

Due to the vendor's lack of response, direct patching is unavailable. As a workaround, implement strict input validation on the homepage/hostname/login_page parameter within the /cgi-bin/login.cgi script, if possible. Consider using a Web Application Firewall (WAF) to filter out malicious requests containing suspicious JavaScript code. Regularly monitor router logs for unusual activity, particularly requests targeting /cgi-bin/login.cgi with unusual parameters. After implementing these mitigations, verify their effectiveness by attempting to inject a simple JavaScript payload and confirming it is blocked.