{"id":"CVE-2026-120195","kind":"vulnerability","aliases":["CVE-2026-120195"],"related":[],"title":"WAVLINK WL-WN579A3-A router: remote command injection via setup wizard","description":"A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","summary":"The Initial Setup Wizard of the WAVLINK WL-WN579A3-A router fails to sanitize the wlan_ssid argument sent to the set_wzdgwMesh function in /cgi-bin/adm.cgi. An attacker who can reach the device over the network can inject operating system commands and run them on the router.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WL-WN579A3-A","fixed":[],"affected":"2026-03-10-94f93d4","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded-linux","home-router","infrastructure","wavlink","wl-wn579a3-a"],"not_affected_if":["different-model","management-not-exposed"],"how_to_check":"- Confirm the model is WAVLINK WL-WN579A3-A and check firmware build 2026-03-10-94f93d4 (the only build the sources name; other builds are unconfirmed)\n- Check whether the web admin interface or /cgi-bin/adm.cgi is reachable from the internet or untrusted networks; sources do not say if login is required","fix":null,"status":"open","published_at":"2026-11-01T04:18:46+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","triaged_at":"2026-11-01T04:48:37+00:00","updated_at":"2026-11-01T04:49:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T04:48:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WL-WN579A3-A router: remote command injection via setup wizard","impact":"high","summary":"The Initial Setup Wizard of the WAVLINK WL-WN579A3-A router fails to sanitize the wlan_ssid argument sent to the set_wzdgwMesh function in /cgi-bin/adm.cgi. An attacker who can reach the device over the network can inject operating system commands and run them on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","home-router","wl-wn579a3-a","embedded-linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Check the vendor advisory and NVD entry for a firmware fix and whether authentication is required to reach set_wzdgwMesh.","how_to_check":"- Confirm the device model is WAVLINK WL-WN579A3-A and check its firmware build against `2026-03-10-94f93d4`\n- Check whether the web admin interface or /cgi-bin/adm.cgi is reachable from outside the local network\n- unknown for any further checks, as the sources do not say","plain_action":"Check whether your WAVLINK WL-WN579A3-A router is running firmware 2026-03-10-94f93d4 and watch for a vendor update; the sources do not state a fix yet.","needs_analyst":true,"not_affected_if":["different-model","management-not-exposed"],"who_is_affected":"Owners of the WAVLINK WL-WN579A3-A router running the affected firmware build are exposed, particularly if its web setup pages can be reached from the internet. Networks that do not use this model, or that keep its management interface off untrusted networks, are less exposed. The sources do not say whether the flaw needs the setup wizard to be active after initial configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000774,"input_tokens":4193,"output_tokens":709,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor advisory and NVD entry for a firmware fix and whether authentication is required to reach set_wzdgwMesh.","search":"'-03':95C '-10':96C '-120195':15A,18A '-2026':14A,17A '-94':97C '/cgi-bin/adm.cgi':60B,110C '2026':94C 'a':22A 'argument':52B,121C 'attack':62B,130C 'carri':135C 'command':8A,75B,127C 'compon':113C 'contact':151C 'cve':13A,16A 'detect':87C 'devic':67B 'disclos':142C 'disclosur':155C 'earli':152C 'element':101C 'embed':24B 'embedded-linux':23B 'exploit':139C 'f93d4':98C 'fail':46B 'file':109C 'function':58B,104C 'home':27B 'home-rout':26B 'impact':100C 'infrastructur':29B 'initi':35B,114C 'inject':9A,72B,128C 'lead':124C 'linux':25B 'manipul':118C 'may':145C 'network':70B 'oper':73B 'os':126C 'possibl':132C 'public':143C 'reach':65B 'remot':7A,137C 'router':6A,28B,45B,81B 'run':77B 'sanit':48B 'secur':83C 'sent':53B 'set':56B,105C 'setup':11A,36B,115C 'ssid':51B,123C 'system':74B 'use':147C 'vendor':149C 'via':10A 'vulner':84C 'wavlink':1A,30B,40B,89C 'wizard':12A,37B,116C 'wl':3A,20A,32B,42B,91C 'wl-wn579a3-a':2A,19A,31B,41B,90C 'wlan':50B,122C 'wn579a3':4A,21A,33B,43B,92C 'wzdgwmesh':57B,106C","nicknames":[],"mitigations":[],"who_affected":"Owners of the WAVLINK WL-WN579A3-A router running the affected firmware build are exposed, particularly if its web setup pages can be reached from the internet. Networks that do not use this model, or that keep its management interface off untrusted networks, are less exposed. The sources do not say whether the flaw needs the setup wizard to be active after initial configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check whether you have a WAVLINK WL-WN579A3-A router and keep its admin page off the internet; no vendor fix is published yet.","first_public_at":"2026-11-01T04:18:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120195","severity":null,"published_at":"2026-11-01T04:18:46+00:00","modified_at":"2026-11-01T04:18:46+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","fetched_at":"2026-11-01T04:47:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120195:1277","url":null,"severity":null,"published_at":"2026-11-01T04:49:26+00:00","modified_at":"2026-11-01T04:49:26+00:00","first_seen_at":"2026-11-01T04:49:26+00:00","fetched_at":"2026-11-01T04:49:26+00:00","note":"No vendor/maintainer advisory found; only NVD and VulDB (vuldb.com/vuln/429558) which say vendor was contacted, exploit public (no PoC link found), no fix reported. Auth requirement not stated by any source. Fix left unknown; nothing verified."}],"documents":[{"id":36890,"url":"https://vuldb.com/vuln/429558","title":"VulDB: WAVLINK WL-WN579A3-A set_wzdgwMesh wlan_ssid os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":36892,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120195","title":"NVD CVE-2026-120195","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}