Critical Buffer Overflow in Wavlink Router Export Pingortrace CGI

CVE-2026-74843 is a critical stack-based buffer overflow vulnerability affecting Wavlink WN531P3 and WN535M1 network devices running firmware version V250922. The vulnerability exists within the 'export_pingortrace.cgi' component, specifically in how the 'strcpy' function processes the 'HTTP_COOKIE' header. Because the application fails to perform adequate bounds checking on the cookie input, a remote, unauthenticated attacker can supply an excessively long string to overwrite the stack, potentially leading to arbitrary code execution. The vulnerability is publicly disclosed, and exploitation code is available, making these devices immediate targets for remote compromise. Given the 10.0 CVSS base score, defenders should prioritize patching or restricting access to the management interface of affected hardware.

Attack Chain

1. Attacker performs reconnaissance to identify vulnerable Wavlink devices exposed to the internet.
2. Attacker crafts a malicious HTTP request targeting the 'export_pingortrace.cgi' endpoint.
3. Attacker injects an overly long string into the 'HTTP_COOKIE' header field of the HTTP request.
4. The web server receives the request and passes the 'HTTP_COOKIE' data to the 'strcpy' function within 'export_pingortrace.cgi'.
5. The 'strcpy' function executes without sufficient length validation, resulting in a stack-based buffer overflow.
6. The attacker redirects execution flow to injected shellcode or ROP gadgets contained within the payload.
7. Attacker gains remote code execution on the device, typically running with root or administrative privileges.
8. Attacker establishes persistence or pivots to the internal network from the compromised router.

Impact

Successful exploitation allows for full remote code execution on the affected Wavlink routers. As these devices act as network gateways, a compromise grants an attacker the ability to intercept traffic, conduct man-in-the-middle attacks, or use the device as a beachhead to attack other internal assets. Given the public availability of the exploit, widespread opportunistic scanning is likely.

Recommendation

• Immediately identify and restrict internet-facing management interfaces for Wavlink WN531P3 and WN535M1 devices.
• Update firmware on all identified affected devices to a version patched against CVE-2026-74843.
• Monitor network perimeter logs for HTTP requests directed at '/cgi-bin/export_pingortrace.cgi' that contain unusually large 'Cookie' headers.
• Deploy Sigma rules targeting large or malicious payloads directed at the vulnerable CGI script in your web server logs.