{"id":"CVE-2026-120196","kind":"vulnerability","aliases":["CVE-2026-120196"],"related":[],"title":"WAVLINK WN579X3-D router: command injection via port forwarding lets remote attackers run commands","description":"A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN579X3-D router firmware (V250402) does not sanitize the Name argument of the port_forward function in /cgi-bin/wapi.cgi, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit is available.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN579X3-D","fixed":[],"affected":"V250402","ecosystem":"vendor"}],"ecosystems":[],"tags":["cgi","embedded","infrastructure","routers","wavlink"],"not_affected_if":["no-internet-exposed-admin","other-models"],"how_to_check":"- Check firmware version in the router admin page; V250402 is the affected version.\n- Check whether the admin interface or /cgi-bin/wapi.cgi is reachable from the internet (WAN side) and disable remote management if so.","fix":null,"status":"open","published_at":"2026-11-01T04:18:46+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","triaged_at":"2026-11-01T04:48:36+00:00","updated_at":"2026-11-01T04:49:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T04:48:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN579X3-D router: command injection via port forwarding lets remote attackers run commands","impact":"high","summary":"The WAVLINK WN579X3-D router firmware (V250402) does not sanitize the Name argument of the port_forward function in /cgi-bin/wapi.cgi, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit is available.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wavlink","routers","embedded","cgi"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router","analyst_note":"Check the vendor advisory or NVD for a fixed firmware version and whether authentication is required for wapi.cgi.","how_to_check":"- Check the firmware version on the device admin page; the affected version is `V250402`.\n- Check whether the admin interface or `/cgi-bin/wapi.cgi` is reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["other-models","no-internet-exposed-admin"],"who_is_affected":"Owners of WAVLINK WN579X3-D routers running firmware V250402 are exposed, especially if the management interface is reachable from outside the network. Sources do not say whether the vendor has released a fixed firmware version. Teams not using this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000697,"input_tokens":4126,"output_tokens":569,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor advisory or NVD for a fixed firmware version and whether authentication is required for wapi.cgi.","search":"'-120196':18A,21A '-2026':17A,20A '/cgi-bin/wapi.cgi':50B,98C 'affect':90C 'arbitrari':66B 'argument':43B,103C 'attack':13A,54B,63B,111C 'avail':78B 'cgi':25B 'command':6A,15A,69B,108C 'contact':129C 'cve':16A,19A 'd':4A,24A,34B,87C 'detect':82C 'devic':72B 'disclosur':133C 'earli':130C 'embed':26B 'exploit':76B,118C 'file':97C 'firmwar':36B 'forward':10A,47B,94C 'function':48B,92C 'infrastructur':27B 'inject':7A,109C 'input':55B 'let':11A 'manipul':100C 'may':112C,123C 'name':42B,104C 'oper':58B,67B 'os':107C 'pass':53B 'perform':114C 'port':9A,46B,93C 'public':75B,121C 'remot':12A,62B,116C 'result':105C 'router':5A,28B,35B 'run':14A,65B 'sanit':40B 'shell':60B 'system':59B,68B 'use':125C 'v250402':37B,88C 'vendor':127C 'via':8A 'vulner':80C 'wavlink':1A,29B,31B,84C 'wn579x3':3A,23A,33B,86C 'wn579x3-d':2A,22A,32B,85C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN579X3-D routers running firmware V250402. The flaw is in the Name argument of port_forward in /cgi-bin/wapi.cgi; the CVSS vector lists low privileges required (PR:L), so a logged-in or low-privilege session is likely needed, but this is not confirmed by the vendor. Exposed most if the admin interface is reachable from the internet; other WAVLINK models are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T04:18:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120196","severity":null,"published_at":"2026-11-01T04:18:46+00:00","modified_at":"2026-11-01T04:18:46+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","fetched_at":"2026-11-01T04:47:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120196:1276","url":null,"severity":null,"published_at":"2026-11-01T04:49:27+00:00","modified_at":"2026-11-01T04:49:27+00:00","first_seen_at":"2026-11-01T04:49:27+00:00","fetched_at":"2026-11-01T04:49:27+00:00","note":"Only NVD/VulDB (VDB-429559) read; no vendor advisory, no fixed firmware found (OpenCVE: no remediation yet). CVSS vector PR:L suggests auth needed. PoC reported public by VulDB but link not found. Nothing verified."}],"documents":[{"id":36891,"url":"https://vuldb.com/vuln/429559","title":"VDB-429559 WAVLINK WN579X3-D V250402 wapi.cgi port_forward os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":36893,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120196","title":"NVD CVE-2026-120196","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}