CVE-2026-7691 | Wavlink WL-WN570HA1 R70HA1 V1410_221110 /cgi-bin/adm.cgi set_sys_cmd command command injection

A vulnerability labeled as critical has been found in Wavlink WL-WN570HA1 R70HA1 V1410_221110. Impacted is the function set_sys_cmd of the file /cgi-bin/adm.cgi. Such manipulation of the argument command leads to command injection. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is referenced as CVE-2026-7691. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Once again the vendors acted very professional and confirms, “that the WN570HA1 firmware version R70HA1 V1410_221110 has been removed from our website.”