---
id: "CVE-2026-120196"
kind: "vulnerability"
aliases: ["CVE-2026-120196"]
title: "WAVLINK WN579X3-D router: command injection via port forwarding lets remote attackers run commands"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN579X3-D", "fixed": [], "affected": "V250402", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cgi", "embedded", "infrastructure", "routers", "wavlink"]
not_affected_if: ["no-internet-exposed-admin", "other-models"]
published_at: "2026-11-01T04:18:46+00:00"
first_seen_at: "2026-11-01T04:47:50+00:00"
updated_at: "2026-11-01T04:49:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120196", "first_seen_at": "2026-11-01T04:47:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T04:49:27+00:00"}]
---

# WAVLINK WN579X3-D router: command injection via port forwarding lets remote attackers run commands

The WAVLINK WN579X3-D router firmware (V250402) does not sanitize the Name argument of the port_forward function in /cgi-bin/wapi.cgi, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device, and a public exploit is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN579X3-D affected V250402 fixed ?

## How to check

- Check firmware version in the router admin page; V250402 is the affected version.
- Check whether the admin interface or /cgi-bin/wapi.cgi is reachable from the internet (WAN side) and disable remote management if so.

## Timeline

- 2026-11-01T04:47:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120196
- 2026-11-01T04:49:27+00:00 analyst — Only NVD/VulDB (VDB-429559) read; no vendor advisory, no fixed firmware found (OpenCVE: no remediation yet). CVSS vector PR:L suggests auth needed. PoC reported public by VulDB but link not found. Nothing verified.

## Documents

- [describes] VDB-429559 WAVLINK WN579X3-D V250402 wapi.cgi port_forward os command injection https://vuldb.com/vuln/429559
- [describes] NVD CVE-2026-120196 https://nvd.nist.gov/vuln/detail/CVE-2026-120196

## From the sources

A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_