This vulnerability involves command injection in the set_sys_cmd function of the /cgi-bin/adm.cgi file in Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110. Remote attackers can exploit this flaw by manipulating the command argument to execute arbitrary system commands. The affected firmware version has been removed from the vendor's website and is no longer supported, indicating no official fix is available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote command injection, potentially enabling attackers to execute arbitrary commands on the device. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. The affected firmware is no longer supported, which increases risk for users still running this version.

The vendor has removed the vulnerable firmware version from their website and no longer supports it. No official patch or fix is available. Users should upgrade to a supported and updated firmware version or replace the affected device to mitigate this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if available.