A stack-based buffer overflow vulnerability (CVE-2026-18607) has been identified in multiple Wavlink router models including WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557, and NU516 up to firmware version 20260609. The vulnerability exists in the strcpy function within the upload.cgi file of the lighttpd component. Attackers can exploit this by manipulating the HTTP_COOKIE argument to trigger a stack-based buffer overflow remotely. The attack can be initiated without physical access to the device. A public exploit has been disclosed and is available for use. This affects a wide range of Wavlink networking devices, increasing the risk of widespread exploitation. The vulnerability poses a significant risk to network infrastructure security.