CVE-2026-3715 HIGH

CVE-2026-3715: Wavlink WL-WN579X3-C firewall.cgi sub_40139C stack-based overflow

Vendor Wavlink
Product WL-WN579X3-C
Weakness CWE-121
Published March 8, 2026
Last update March 11, 2026

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in Wavlink WL-WN579X3-C 231124. This affects the function sub_40139C of the file /cgi-bin/firewall.cgi. Performing a manipulation of the argument del_flag results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 20260226 is able to mitigate this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Key dates

02Disclosure timeline

March 8, 2026 CVE published
March 11, 2026 Record updated