Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting

Successful exploitation of CVE-2026-6559 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Wavlink WL-WN579A3 device's web interface. This can lead to various malicious actions, including session hijacking, credential theft (if login credentials are stored or transmitted insecurely), and defacement of the device's web pages. The attacker could potentially gain control of the device and use it as a pivot point to attack other systems on the network. While the vulnerability is remote, it requires the attacker to be able to access the device's web interface, typically via a network connection.

Small businesses and home users who rely on the Wavlink WL-WN579A3 wireless adapter for network connectivity are at risk. Environments where the device is used as a gateway or access point, potentially exposing internal network resources, face a higher level of risk. Users who have not updated their device's firmware are particularly vulnerable.

• linux / server:

journalctl -u wlan_service | grep -i "login.cgi"

• generic web:

curl -I http://<device_ip>/cgi-bin/login.cgi | grep Hostname

1. 2026-04-19Disclosure

   disclosure

1. Reserviert2026-04-18
2. Veröffentlicht2026-04-19
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-26

The primary mitigation for CVE-2026-6559 is to upgrade the Wavlink WL-WN579A3 firmware to the fixed version released by the vendor. Since the vulnerability is in a web interface, consider implementing stricter input validation and output encoding on the device's web server to prevent future XSS attacks. If upgrading is not immediately possible, restrict access to the device's web interface using a firewall or access control list (ACL) to limit potential attackers. Monitor network traffic for suspicious activity targeting the device’s login page.