CVE-2026-3716 is a cross-site scripting vulnerability affecting the Wavlink WL-WN579X3-C router, version 231124. The flaw exists in the sub_401AD4 function within the /cgi-bin/adm.cgi CGI script, where the Hostname parameter is not properly sanitized before being reflected in the web interface. This allows an attacker to inject arbitrary JavaScript code that executes in the context of the router's administrative web interface. The attack can be launched remotely without authentication, but requires the victim (likely an administrator) to interact with a maliciously crafted URL or page. The vulnerability could enable attackers to steal session cookies, perform unauthorized actions on behalf of the admin, or conduct further attacks within the network. The vendor responded promptly and released a fixed firmware version 20260226 to address the issue. The CVSS 4.8 score reflects the medium severity due to the need for user interaction and limited impact on confidentiality and integrity. No known exploits have been observed in the wild yet, but public disclosure increases the risk of exploitation.

The primary impact of this vulnerability is the potential compromise of the router's administrative interface through cross-site scripting. Successful exploitation could allow attackers to hijack administrator sessions, manipulate router settings, or pivot into the internal network. This could lead to network disruption, unauthorized access to sensitive network configurations, or interception of internal traffic. While the vulnerability does not directly affect the router's core firmware or availability, the administrative compromise can have cascading effects on network security. Organizations relying on this router model, especially those with remote or less-secure administrative access, face increased risk of targeted attacks. The medium CVSS score indicates moderate risk, but the ease of remote exploitation without authentication elevates the threat level for exposed devices.

Organizations should immediately upgrade affected Wavlink WL-WN579X3-C devices to firmware version 20260226 or later, which contains the fix for this vulnerability. Additionally, administrators should restrict access to the router's web interface by limiting it to trusted networks or VPNs and disabling remote administration if not required. Implementing strong, unique administrator passwords and enabling multi-factor authentication where supported can reduce the risk of session hijacking. Network monitoring for unusual administrative access patterns and user education to avoid clicking on suspicious links can further mitigate exploitation risk. Regularly auditing router firmware versions and applying security patches promptly is critical. If upgrading is temporarily not possible, consider isolating the device from untrusted networks and using web application firewalls to detect and block XSS payloads targeting the router interface.