CVE-2026-18607: Wavlink Router Buffer Overflow Vulnerability

CVE-2026-18607 Overview

CVE-2026-18607 is a stack-based buffer overflow in the lighttpd component of multiple Wavlink router models, including WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557, and NU516 firmware up to version 20260609. The vulnerability resides in the strcpy function within upload.cgi, where the HTTP_COOKIE header value is copied into a fixed-size stack buffer without length validation. Remote attackers can send a crafted HTTP request with an oversized cookie value to corrupt the stack. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against exposed devices [CWE-119].

Critical Impact
Remote attackers can trigger memory corruption on affected Wavlink routers via a crafted HTTP_COOKIE header, enabling potential code execution and full device compromise.

Affected Products

Wavlink WN572, WN570H, WN573 (firmware up to 20260609)
Wavlink WN529, WN530, WN531, WN535, WN536 (firmware up to 20260609)
Wavlink WN551, WN557, and NU516 (firmware up to 20260609)

Discovery Timeline

2026-08-03 - CVE-2026-18607 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18607

Vulnerability Analysis

The vulnerability affects the upload.cgi binary served by the lighttpd web server on multiple Wavlink router models. When processing incoming HTTP requests, upload.cgi reads the HTTP_COOKIE environment variable and copies it into a fixed-size stack buffer using strcpy. Because strcpy does not check destination buffer size, an attacker-supplied cookie longer than the buffer overwrites adjacent stack memory, including the saved return address.

This class of memory corruption on MIPS or ARM-based embedded routers typically results in arbitrary code execution as the web server process, which commonly runs with root privileges on consumer networking gear. Successful exploitation grants full control over the device, including credential extraction, LAN pivoting, and persistent implant deployment.

Root Cause

The root cause is the use of the unsafe strcpy function without validating the length of attacker-controlled input from the HTTP_COOKIE header. The affected code path lacks input sanitization and bounds checking, which is a common defect in low-level CGI handlers written in C for embedded systems [CWE-119].

Attack Vector

Exploitation is performed remotely over the network by sending a single HTTP request to upload.cgi with an oversized Cookie header. The attack requires low privileges and no user interaction. Because the vulnerable endpoint is exposed by the router's built-in web administration interface, any attacker with network reachability to the device can attempt exploitation. A public proof-of-concept for CVE-2026-18607 has been released, lowering the exploitation barrier.

Refer to the GitHub PoC Repository and VulDB Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-18607

Indicators of Compromise

HTTP requests to /upload.cgi on the router's management interface containing abnormally long Cookie header values, typically exceeding several hundred bytes.
Unexpected reboots, crashes, or watchdog resets of the lighttpd process on affected Wavlink routers.
New or unexpected outbound connections initiated from the router to unknown hosts following suspicious HTTP traffic.
Modifications to router configuration, DNS settings, or firewall rules that were not made by an administrator.

Detection Strategies

Inspect HTTP traffic destined to router management interfaces for Cookie headers exceeding reasonable length thresholds (e.g., >512 bytes).
Deploy network intrusion detection signatures that flag POST or GET requests targeting upload.cgi with malformed or oversized cookies.
Monitor DHCP and ARP tables to identify Wavlink devices on the network and correlate their firmware versions against the affected list.

Monitoring Recommendations

Log and alert on any external access attempts to router administration ports (typically TCP/80 and TCP/443) from untrusted networks.
Aggregate syslog output from Wavlink devices, if supported, and monitor for repeated lighttpd crash events.
Track outbound traffic patterns from the router itself, as a compromised device will initiate command-and-control communications.

How to Mitigate CVE-2026-18607

Immediate Actions Required

Restrict access to the router's web management interface to trusted LAN segments only and disable WAN-side administration.
Identify all Wavlink devices in the environment running firmware version 20260609 or earlier and isolate them from untrusted networks.
Block inbound HTTP and HTTPS traffic to affected models from the internet at the perimeter firewall.
Rotate administrative credentials on affected routers in case prior compromise occurred.

Patch Information

At the time of publication, no vendor advisory or firmware patch from Wavlink has been referenced in the CVE record. Administrators should monitor the VulDB CVE Record and Wavlink's official support channels for firmware updates addressing CVE-2026-18607.

Workarounds

Place affected Wavlink routers behind an upstream firewall that filters HTTP requests to the management interface.
Where feasible, replace end-of-life or unpatched Wavlink models with actively supported networking hardware.
Implement network segmentation to limit the blast radius if a router is compromised, isolating IoT and management VLANs from sensitive assets.

bash

# Example: block external access to Wavlink router management interface
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -j DROP