Live › vulnerability › CVE-2026-120197
The port_forward function of /cgi-bin/wapi.cgi in WAVLINK WL-WN530HG4B firmware M_V260724 passes the Name argument into an operating system command. VulDB says it can be attacked remotely and a proof-of-concept exploit is public. The CVSS vector lists low privileges required, so a login to the router is probably needed; the sources do not say this outright. VulDB says the vendor was contacted and knows of no countermeasure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 04:47 UTC. All times on this page are UTC.
WAVLINK WL-WN530HG4B routers running firmware M_V260724 are affected through the port forwarding handler in wapi.cgi. The CVSS vector suggests a login is needed, so units whose admin page is reachable from the internet or by other people on the network are most at risk. Other models and firmware versions are not confirmed affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WL-WN530HG4B | vendor | M_V260724 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120197")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.