CVE-2026-74843 is a stack-based buffer overflow vulnerability in Wavlink WN531P3 and WN535M1 V250922 devices. The vulnerability arises from unsafe use of the strcpy function in the Export Pingortrace CGI script (/etc/lighttpd/www/cgi-bin/export_pingortrace.cgi). An attacker can remotely manipulate the HTTP_COOKIE argument to overflow the stack, potentially leading to arbitrary code execution. The vulnerability has a CVSS 4.0 base score of 10.0 (critical) with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Public exploit code has been disclosed, but no official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to remote code execution on affected devices without requiring authentication or user interaction. This can compromise the confidentiality, integrity, and availability of the device and potentially the network it resides on. The vulnerability is critical with a CVSS score of 10.0, indicating maximum severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the vulnerable device's management interfaces to trusted sources only and monitor for suspicious activity related to the export_pingortrace.cgi endpoint. Avoid exposing the device directly to untrusted networks.