CVE-2026-18607

The CVE-2026-18607 affects Wavlink devices including WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557, and NU516 (firmware up to 20260609). The vulnerability targets the strcpy function in lighttpd’s file upload.cgi, where manipulating the HTTP_COOKIE argument triggers a stac...