Live › vulnerability › CVE-2026-120195
The Initial Setup Wizard of the WAVLINK WL-WN579A3-A router fails to sanitize the wlan_ssid argument sent to the set_wzdgwMesh function in /cgi-bin/adm.cgi. An attacker who can reach the device over the network can inject operating system commands and run them on the router.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 04:47 UTC. All times on this page are UTC.
Owners of the WAVLINK WL-WN579A3-A router running the affected firmware build are exposed, particularly if its web setup pages can be reached from the internet. Networks that do not use this model, or that keep its management interface off untrusted networks, are less exposed. The sources do not say whether the flaw needs the setup wizard to be active after initial configuration.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WL-WN579A3-A | vendor | 2026-03-10-94f93d4 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.