An unauthenticated command injection vulnerability in the Wavlink WL-WN578W2 firmware allows remote attackers to execute arbitrary system commands, posing a severe risk of total device compromise.

The vulnerability exists within the sub_401C5C function of the firewall.cgi script, where multiple parameters are processed without adequate sanitization. An unauthenticated attacker can send a crafted POST request to the device to inject and execute arbitrary shell commands with root privileges.

Successful exploitation of this vulnerability grants an attacker full control over the affected wireless range extender. This level of access enables the attacker to exfiltrate sensitive network traffic, plant persistent backdoors for long-term espionage, or pivot into the internal network. Given the CVSS score of 7.3, this flaw presents a high risk to organizational security, particularly if these devices are deployed in sensitive segments of the corporate infrastructure.

Immediate Action: As there is currently no official patch available from the vendor, administrators should immediately restrict access to the device management interface to trusted internal IP addresses only. If possible, disconnect affected devices from the public-facing network segments until a vendor-supplied firmware update is released.

Proactive Monitoring: Monitor firewall and network access logs for suspicious POST requests directed at the /cgi-bin/firewall.cgi endpoint. Look specifically for payloads containing shell metacharacters such as semicolons, ampersands, or pipe symbols.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to inspect and block incoming traffic containing malicious command injection strings targeting the vulnerable firewall configuration parameters.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability must be treated with high urgency. Organizations should prioritize isolating these devices from the network and implementing strict access controls to prevent unauthorized command execution until the vendor provides a remediation path.