A critical buffer overflow vulnerability in the Wavlink M86X3A router permits unauthenticated remote code execution, posing a severe risk to network integrity.

This is a buffer overflow flaw located in the /cgi-bin/ExportAllSettings.cgi file, triggered by improper input validation of the Cookie parameter. The CVSS vector (AV:A/AC:L/PR:N) confirms that an unauthenticated attacker on the adjacent network can exploit this vulnerability without user interaction.

The ability for an unauthenticated attacker to execute arbitrary code on network infrastructure can lead to full system compromise, unauthorized access to sensitive traffic, and total loss of device availability. With a CVSS score of 7.5, this high-severity vulnerability represents a significant threat to internal network security and operational continuity.

Immediate Action: Contact the vendor immediately to obtain firmware updates that address this buffer overflow, as no public patch is currently confirmed.

Proactive Monitoring: Monitor network traffic for unusual activity directed at the /cgi-bin/ directory and inspect device logs for signs of segmentation faults or unexpected reboots.

Compensating Controls: Implement strict network segmentation to isolate the affected device from untrusted segments and utilize a Web Application Firewall to block requests containing malformed or excessively long Cookie strings.

Public Exploit Available: Yes — a published proof-of-concept exists as referenced in the vulnerability research write-up on GitHub.

Given the potential for remote code execution and the availability of a public proof-of-concept, this vulnerability must be treated with high priority. Administrators should isolate affected devices from the internet immediately and prioritize firmware remediation once the manufacturer releases a secure update.