CVE-2026-18607

Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

High8.7EPSS 0.79%

Published: 3 Aug 2026
Updated: 3 Aug 2026
Reserved: 3 Aug 2026
Assigned by: VulDB

Description

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Scores

CVSS scores of CVE-2026-18607, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDBCNA (assigner)	3.0	High8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDBCNA (assigner)	2.0	Critical9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
NVDNVD · Deferred	4.0	High7.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.79% · top 43% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

Affected products

Wavlink · WN572
- affected 20260609
Wavlink · WN570H
- affected 20260609
Wavlink · WN573
- affected 20260609
Wavlink · WN529
- affected 20260609
Wavlink · WN530
- affected 20260609
Wavlink · WN531
- affected 20260609
Wavlink · WN535
- affected 20260609
Wavlink · etc. WN529
- affected 20260609
Wavlink · WN530
- affected 20260609
Wavlink · WN531
- affected 20260609
Wavlink · WN535
- affected 20260609
Wavlink · WN536
- affected 20260609
Wavlink · WN551
- affected 20260609
Wavlink · WN557
- affected 20260609
Wavlink · NU516
- affected 20260609

References (5)

VDB-385530 | Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow (opens in a new tab)vdb-entrytechnical-description
VDB-385530 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
CVE-2026-18607 | CVE Analysis and Report (opens in a new tab)third-party-advisory
Submit #852637 | WAVLINK Multiple Router Series (WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc.) WN529, WN530, WN531, WN535, WN536, WN551, WN557, NU516,and so on Stack-based Buffer Overflow (opens in a new tab)third-party-advisory
https://github.com/0xcc12138/WAVLINK-vul (opens in a new tab)exploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-18607](https://trackcve.app/badge/CVE-2026-18607.svg)](https://trackcve.app/cve/CVE-2026-18607)

Record last updated 3 Aug 2026, 20:23 UTC.