Description

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-17T12:18:58.180Z",
  "pubdate": "2026-08-17T12:18:58.180Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in Wavlink WN531P3 and WN535M1 running firmware version V250922. The security flaw specifically resides within the export_pingortrace.cgi binary, located at the file path /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi, inside the Export Pingortrace CGI component. The vulnerability is triggered via improper handling of the HTTP_COOKIE argument during processing by the strcpy function.\nSuccessful exploitation of this memory corruption vulnerability allows a remote, unauthenticated attacker to overwrite stack memory, potentially leading to arbitrary code execution or a complete denial of service of the affected routing device. The attack vector is fully network-accessible, and public exploit disclosures are currently available in the wild, significantly elevating the risk profile for operational deployments.\nGiven that the vendor was contacted early regarding this disclosure but native patch details remain restricted or unavailable, mitigation relies heavily on network segmentation, ingress filtering, and disabling remote management interfaces where feasible.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, stemming from the unsafe use of the standard C library function strcpy within the Export Pingortrace CGI component of the affected Wavlink firmware. Specifically, the binary located at /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi insecurely copies data derived from the HTTP_COOKIE environment variable or HTTP header into a fixed-length stack buffer without performing adequate bounds checking or length validation.\nAttack flow begins when an external threat actor crafts a malicious HTTP request containing an oversized payload within the HTTP_COOKIE parameter. Because the HTTP service parses incoming cookie strings and passes them directly to the vulnerable export_pingortrace.cgi script, the underlying web server passes the malicious input to the request handler. As the application executes the strcpy function, the input stream exceeds the pre-allocated memory boundaries of the destination buffer on the stack.\nThis unchecked data overflow overwrites adjacent stack memory structures, including saved frame pointers and return addresses. By carefully structuring the payload, an attacker can hijack the control flow of the application upon function return. The affected versions include Wavlink WN531P3 and WN535M1 running version V250922.\nNetwork exposure is fully remote, as the Common Gateway Interface (CGI) binary is exposed via the embedded web server (lighttpd) running on the device. Exploitation does not inherently require prior authentication or privileged access, allowing remote unauthenticated attackers on the network to launch the attack. Post-exploitation impact includes application crashes causing denial of service conditions, or the potential execution of arbitrary shell commands or malicious payloads with the privileges of the web server process."
}