CVE-2026-18607 is a stack-based buffer overflow vulnerability in the strcpy function of the upload.cgi component of lighttpd on various Wavlink routers (including models WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557, and NU516 up to 20260609). The vulnerability arises from improper handling of the HTTP_COOKIE argument, allowing remote attackers to overflow the stack buffer. This can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 8.8 (high) and has been publicly disclosed, though no known exploits in the wild have been confirmed. No patch or official remediation guidance is currently provided.

Successful exploitation allows remote attackers to execute arbitrary code or cause denial of service by triggering a stack-based buffer overflow via the HTTP_COOKIE argument in upload.cgi. This impacts confidentiality, integrity, and availability of affected devices. The vulnerability affects multiple Wavlink router models and can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable service or restricting access to the affected component if possible. Monitor vendor channels for updates.