A critical unauthenticated command injection vulnerability in Wavlink WL-WN578W2 firmware allows remote attackers to execute arbitrary commands with root privileges.

The device fails to properly sanitize user input in the sel_EncrypTyp parameter within the wizard_rep.shtml page, which is processed by the /cgi-bin/adm.cgi endpoint. Because the input filter is insufficient and does not require authentication, an unauthenticated remote attacker can inject system commands that execute with root-level permissions.

Successful exploitation of this vulnerability allows for full device compromise, potentially resulting in unauthorized data exfiltration, the installation of persistent backdoors, or complete loss of network control. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of the affected network infrastructure.

Immediate Action: As no vendor patch is currently available, disconnect the affected device from the public internet immediately to prevent remote access.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the device, particularly those originating from the /cgi-bin/adm.cgi endpoint, which may indicate command injection attempts.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses only via firewall rules, and disable remote management features to mitigate the risk of unauthenticated exploitation.

Public Exploit Available: Yes — a functional proof-of-concept exists as detailed in the technical write-up by n0ps1ed.

This vulnerability presents a severe risk due to the potential for unauthenticated remote code execution with root privileges. Since the vendor has not provided a security update, administrators must prioritize network isolation and the implementation of strict access controls to prevent unauthorized access to the device. Ensure that all management interfaces are inaccessible from untrusted networks until a vendor-supplied firmware fix is applied.