---
id: "CVE-2026-120195"
kind: "vulnerability"
aliases: ["CVE-2026-120195"]
title: "WAVLINK WL-WN579A3-A router: remote command injection via setup wizard"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WL-WN579A3-A", "fixed": [], "affected": "2026-03-10-94f93d4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded-linux", "home-router", "infrastructure", "wavlink", "wl-wn579a3-a"]
not_affected_if: ["different-model", "management-not-exposed"]
published_at: "2026-11-01T04:18:46+00:00"
first_seen_at: "2026-11-01T04:47:50+00:00"
updated_at: "2026-11-01T04:49:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120195", "first_seen_at": "2026-11-01T04:47:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T04:49:26+00:00"}]
---

# WAVLINK WL-WN579A3-A router: remote command injection via setup wizard

The Initial Setup Wizard of the WAVLINK WL-WN579A3-A router fails to sanitize the wlan_ssid argument sent to the set_wzdgwMesh function in /cgi-bin/adm.cgi. An attacker who can reach the device over the network can inject operating system commands and run them on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WL-WN579A3-A affected 2026-03-10-94f93d4 fixed ?

## How to check

- Confirm the model is WAVLINK WL-WN579A3-A and check firmware build 2026-03-10-94f93d4 (the only build the sources name; other builds are unconfirmed)
- Check whether the web admin interface or /cgi-bin/adm.cgi is reachable from the internet or untrusted networks; sources do not say if login is required

## Timeline

- 2026-11-01T04:47:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120195
- 2026-11-01T04:49:26+00:00 analyst — No vendor/maintainer advisory found; only NVD and VulDB (vuldb.com/vuln/429558) which say vendor was contacted, exploit public (no PoC link found), no fix reported. Auth requirement not stated by any source. Fix left unknown; nothing verified.

## Documents

- [describes] VulDB: WAVLINK WL-WN579A3-A set_wzdgwMesh wlan_ssid os command injection https://vuldb.com/vuln/429558
- [describes] NVD CVE-2026-120195 https://nvd.nist.gov/vuln/detail/CVE-2026-120195

## From the sources

A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_