This vulnerability affects Wavlink WL-WN579X3-C version 231124. A stack-based buffer overflow can be triggered remotely by manipulating the UpnpEnabled argument processed by the sub_4019FC function in the /cgi-bin/firewall.cgi script within the UPNP Handler component. The vulnerability allows for potential memory corruption, which could lead to arbitrary code execution or denial of service. The CVSS 4.0 score is 8.7 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and the exploit code is publicly available.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. Given the network attack vector and lack of required privileges or user interaction, attackers can remotely exploit this flaw to gain control or disrupt device operation. No confirmed active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider disabling UPNP functionality if possible to reduce exposure. Monitor official Wavlink channels for updates or patches addressing this vulnerability.