Cross-Site Scripting Vulnerability in Wavlink WL-WN579A3 Router

CVE-2026-6559

What is CVE-2026-6559?

A cross-site scripting (XSS) vulnerability exists in the Wavlink WL-WN579A3 router due to improper handling of the 'Hostname' argument in the /cgi-bin/login.cgi file. This flaw allows remote attackers to execute arbitrary scripts in the context of the user's session, potentially leading to unauthorized access and data exposure. The vendor has addressed this security issue and released an upgraded version of the device to mitigate the risk. Users are strongly encouraged to update their firmware to the latest version to protect against potential exploitation.

References