Critical Remote Code Execution Vulnerability in Wavlink SOHO Routers: CVE-2026-74843 Exploited in the Wild

Overview

CVE-2026-74843 is a CVSS 10.0 stack-based buffer overflow vulnerability in Wavlink WN531P3/535M1 routers, enabling unauthenticated remote code execution via manipulated HTTP_COOKIE headers. Public exploits exist, necessitating immediate remediation for affected devices in enterprise and DIB networks.

Technical Analysis

The vulnerability stems from unchecked use of strcpy() in the export_pingortrace.cgi CGI script, which processes the HTTP_COOKIE header without length validation. Attackers can craft oversized cookies to overwrite the stack and execute arbitrary code with no authentication required. Exploitation requires a single malicious HTTP request to the /cgi-bin/export_pingortrace.cgi endpoint, with no user interaction beyond device network accessibility. The exploit chain is fully remote, leveraging common lighttpd CGI execution patterns.

Enterprise & DIB Impact

While these devices are marketed as consumer-grade, DIB and enterprise environments may deploy them in remote office or IoT architectures, creating potential attack surfaces for supply chain interception or lateral network compromise. The publicly available PoC lowers barriers for scripted scanning campaigns targeting weakly monitored SOHO infrastructure.

Recommended Actions

• Apply firmware updates from Wavlink's official security advisories
• disable unused CGI endpoints on exposed routers
• implement network-layer WAF rules to block oversized HTTP_COOKIE headers
• conduct log analysis for anomalous cgi-bin requests
• and segment SOHO devices from critical internal networks using zero-trust principles.