CVE-2026-74843 is a critical vulnerability affecting Wavlink WN531P3 and WN535M1 devices running version V250922. The vulnerability arises from improper handling of the HTTP_COOKIE argument in the Export Pingortrace CGI component, specifically in the strcpy function, leading to a stack-based buffer overflow (CWE-119). This flaw allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. Public exploit code has been disclosed, but no official patch or fix has been documented. The vendor was contacted early but no remediation details are provided.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected devices. The attacker can exploit the stack-based buffer overflow remotely without authentication, potentially gaining full control over the device or causing it to crash. The vulnerability impacts confidentiality, integrity, and availability at the highest level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices and monitor for suspicious activity related to the export_pingortrace.cgi component. Avoid exposing the device's management interface to untrusted networks.