Live › vulnerability › CVE-2026-120196
The WAVLINK WN579X3-D router firmware (V250402) does not sanitize the Name argument of the port_forward function in /cgi-bin/wapi.cgi, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit is available.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 04:47 UTC. All times on this page are UTC.
Owners of WAVLINK WN579X3-D routers running firmware V250402. The flaw is in the Name argument of port_forward in /cgi-bin/wapi.cgi; the CVSS vector lists low privileges required (PR:L), so a logged-in or low-privilege session is likely needed, but this is not confirmed by the vendor. Exposed most if the admin interface is reachable from the internet; other WAVLINK models are not confirmed affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN579X3-D | vendor | V250402 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.