CVE-2025-10358 | Wavlink WL-WN578W2 221110 /cgi-bin/wireless.cgi sub_404850 delete_list os command injection

A vulnerability was found in Wavlink WL-WN578W2 221110. It has been rated as critical. This affects the function sub_404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to os command injection.

This vulnerability is documented as CVE-2025-10358. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.