CVE-2026-6559: XSS in Wavlink WL-WN579A3

Successful exploitation of CVE-2026-6559 enables an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Wavlink WL-WN579A3 device's web interface. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the device's login page. Given the device's role as a network adapter, a compromised device could potentially be used as a pivot point to attack other devices on the same network, expanding the attack surface. The impact is amplified if the device is used in environments with sensitive data or critical infrastructure.

1. Reserved2026-04-18
2. Published2026-04-19
3. Modified2026-04-20
4. EPSS updated2026-04-26

The primary mitigation for CVE-2026-6559 is to upgrade the Wavlink WL-WN579A3 firmware to the patched version released by the vendor. Since a specific version is not provided, check the Wavlink website for the latest firmware. If upgrading is not immediately feasible, consider implementing strict input validation on the Hostname parameter within the /cgi-bin/login.cgi script to prevent malicious input. While a WAF might offer some protection, it's unlikely to be effective against this type of vulnerability without specific rules tailored to the device's web interface. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) into the Hostname field and confirming that the script is not executed.