Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-18607— Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

Quick assessment

Affected

Wavlink WN572

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WAVLINK wn572是中国WAVLINK公司的一款无线网络设备。 Wavlink WN572、WN570H、WN573、WN529、WN530、WN531、WN535、WN536、WN551、WN557和NU516 20260609及之前版本存在缓冲区错误漏洞，该漏洞源于lighttpd组件中upload.cgi文件的strcpy函数对HTTP_COOKIE参数操作不当，导致栈缓冲区溢出，攻击者可能远程发起攻击。

CVSS 8.8 · High EPSS 0.79% · P55 Updated Aug 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 15

Vendor	Product	Version Range	Status
Wavlink	etc. WN529	`20260609`	affected
Wavlink	NU516	`20260609`	affected
Wavlink	WN529	`20260609`	affected
Wavlink	WN530	`20260609`	affected
		`20260609`	affected
Wavlink	WN531	`20260609`	affected
		`20260609`	affected
Wavlink	WN535	`20260609`	affected
		`20260609`	affected
Wavlink	WN536	`20260609`	affected
Wavlink	WN551	`20260609`	affected
Wavlink	WN557	`20260609`	affected
Wavlink	WN570H	`20260609`	affected
Wavlink	WN572	`20260609`	affected
Wavlink	WN573	`20260609`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18607

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

栈缓冲区溢出

Source: CVE Program / CVE List V5

Vulnerability Title

WAVLINK wn572 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Wavlink	WN572	20260609	`cpe:2.3:a:wavlink:wn572::::::::`
Wavlink	WN570H	20260609	`cpe:2.3:a:wavlink:wn570h::::::::`
Wavlink	WN573	20260609	`cpe:2.3:a:wavlink:wn573::::::::`
Wavlink	WN529	20260609	`cpe:2.3:a:wavlink:wn529::::::::`
Wavlink	WN530	20260609	`cpe:2.3:a:wavlink:wn530::::::::`
Wavlink	WN531	20260609	`cpe:2.3:a:wavlink:wn531::::::::`
Wavlink	WN535	20260609	`cpe:2.3:a:wavlink:wn535::::::::`
Wavlink	etc. WN529	20260609	`cpe:2.3:a:wavlink:etc._wn529::::::::`
Wavlink	WN530	20260609	`cpe:2.3:a:wavlink:wn530::::::::`
Wavlink	WN531	20260609	`cpe:2.3:a:wavlink:wn531::::::::`
Wavlink	WN535	20260609	`cpe:2.3:a:wavlink:wn535::::::::`
Wavlink	WN536	20260609	`cpe:2.3:a:wavlink:wn536::::::::`
Wavlink	WN551	20260609	`cpe:2.3:a:wavlink:wn551::::::::`
Wavlink	WN557	20260609	`cpe:2.3:a:wavlink:wn557::::::::`
Wavlink	NU516	20260609	`cpe:2.3:a:wavlink:nu516::::::::`

II. Public POCs for CVE-2026-18607

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 8788 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-18607

请登录查看更多情报信息。

Proof of Concept for CVE-2026-18607 (1)

🔗 GitHub - 0xcc12138/WAVLINK-vul: only vuldb can open the rar · GitHub exploit

https://www.cve.org/CVERecord?id=CVE-2026-18607

Same Patch Batch · Wavlink · 2026-08-03 · 5 CVEs total

CVE-2026-18589	9.8 CRITICAL	Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
CVE-2026-18588	9.8 CRITICAL	Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow
CVE-2026-18587	7.5 HIGH	Wavlink WL-NU516U1 Config Import os command injection
CVE-2026-18590	6.3 MEDIUM	Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

IV. Related Vulnerabilities

Same vendor: Wavlink

Same weakness: CWE-121

V. Comments for CVE-2026-18607

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18607— Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 15

I. Basic Information for CVE-2026-18607

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-18607

III. Intelligence Information for CVE-2026-18607

Proof of Concept for CVE-2026-18607 (1)

Same Patch Batch · Wavlink · 2026-08-03 · 5 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-18607

Leave a comment