CVE-2025-10358

Wavlink WL-WN578W2 (firmware 221110) exposes an OS command injection in /cgi-bin/wireless.cgi via the delete_list argument in function sub_404850. This remote vulnerability allows arbitrary command execution and has public PoC/disclosures. Multiple sources describe the root cause as improper filt...

CVE-2025-10358: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument deletelist leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly...