CVE-2026-18607 | Wavlink NU516 up to 20260609 lighttpd upload.cgi strcpy HTTP_COOKIE stack-based overflow (EUVD-2026-52371)

A vulnerability marked as . Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow.

This vulnerability is traded as CVE-2026-18607. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.