{"id":"CVE-2026-120197","kind":"vulnerability","aliases":["CVE-2026-120197"],"related":[],"title":"WAVLINK WL-WN530HG4B router: remote command injection via port forwarding","description":"A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","summary":"The port_forward function of /cgi-bin/wapi.cgi in WAVLINK WL-WN530HG4B firmware M_V260724 passes the Name argument into an operating system command. VulDB says it can be attacked remotely and a proof-of-concept exploit is public. The CVSS vector lists low privileges required, so a login to the router is probably needed; the sources do not say this outright. VulDB says the vendor was contacted and knows of no countermeasure.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WL-WN530HG4B","fixed":[],"affected":"M_V260724","ecosystem":"vendor"}],"ecosystems":[],"tags":["cgi","home-router","infrastructure","poc-public","wavlink","wl-wn530hg4b"],"not_affected_if":["different-model","no-firmware-m_v260724"],"how_to_check":"- Open the router admin page and read the firmware version; M_V260724 on a WL-WN530HG4B is the affected one.\n- Check whether the admin interface (and /cgi-bin/wapi.cgi) answers from the WAN side; if so, turn off remote administration.\n- Check the port forwarding entries for odd Name values containing shell characters.","fix":"No fix known: VulDB lists no countermeasure and no WAVLINK advisory was found. Turn off WAN-side administration, change the admin password, or replace the device.","status":"open","published_at":"2026-11-01T04:18:47+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","triaged_at":"2026-11-01T04:48:36+00:00","updated_at":"2026-11-01T04:49:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T04:48:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WL-WN530HG4B router: remote command injection via port forwarding","impact":"high","summary":"A flaw in the port forwarding function of the WAVLINK WL-WN530HG4B router firmware lets the Name argument of /cgi-bin/wapi.cgi carry operating system commands. A remote attacker can run commands on the router without logging in, and a public exploit has been published.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wl-wn530hg4b","home-router","cgi"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Commands run on the router as the attacker chooses","analyst_note":"Sources do not say whether authentication is required or whether a vendor fix exists; check the NVD entry and WAVLINK advisories.","how_to_check":"- Check the firmware version on the router admin page against `M_V260724`\n- Look for the port forwarding page or `/cgi-bin/wapi.cgi` exposed on the WAN side\n- unknown for other checks","plain_action":"If you own a WAVLINK WL-WN530HG4B router, check for a firmware update from WAVLINK and turn off remote administration until one is installed.","needs_analyst":true,"not_affected_if":["different-model","no-firmware-m_v260724"],"who_is_affected":"Devices running WAVLINK WL-WN530HG4B firmware M_V260724 are affected, and the flaw is reachable remotely through the wapi.cgi port forwarding handler. Whether a given unit is reachable from the internet depends on its WAN exposure and remote management settings, which the sources do not describe. Networks that do not use this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000739,"input_tokens":4137,"output_tokens":650,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not say whether authentication is required or whether a vendor fix exists; check the NVD entry and WAVLINK advisories.","search":"'-120197':14A,17A '-2026':13A,16A '/cgi-bin/wapi.cgi':38B,127C 'argument':50B,132C 'attack':61B,144C 'caus':134C 'cgi':21B 'command':7A,55B,136C 'concept':68B 'contact':100B,158C 'countermeasur':105B 'cve':12A,15A 'cvss':73B 'disclosur':162C 'earli':159C 'exploit':69B,147C 'file':126C 'firmwar':44B 'flaw':107C 'forward':11A,35B,123C 'found':110C 'function':36B,121C 'home':23B 'home-rout':22B 'impact':119C 'infrastructur':25B 'initi':142C 'inject':8A,137C 'know':102B 'list':75B 'login':81B 'low':76B 'm':45B,116C 'manipul':129C 'may':152C 'name':49B,133C 'need':87B 'oper':53B 'os':135C 'outright':94B 'pass':47B 'poc':27B 'poc-publ':26B 'port':10A,34B,122C 'possibl':140C 'privileg':77B 'probabl':86B 'proof':66B 'proof-of-concept':65B 'public':28B,71B 'publish':150C 'remot':6A,62B,145C 'requir':78B 'router':5A,24B,84B 'say':57B,92B,96B 'sourc':89B 'system':54B 'use':154C 'v260724':46B,117C 'vector':74B 'vendor':98B,156C 'via':9A 'vuldb':56B,95B 'wavlink':1A,29B,40B,112C 'wl':3A,19A,31B,42B,114C 'wl-wn530hg4b':2A,18A,30B,41B,113C 'wn530hg4b':4A,20A,32B,43B,115C","nicknames":[],"mitigations":[],"who_affected":"WAVLINK WL-WN530HG4B routers running firmware M_V260724 are affected through the port forwarding handler in wapi.cgi. The CVSS vector suggests a login is needed, so units whose admin page is reachable from the internet or by other people on the network are most at risk. Other models and firmware versions are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WL-WN530HG4B router, turn off remote administration in its settings and use a strong admin password, as WAVLINK has not released a fix yet.","first_public_at":"2026-11-01T04:18:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120197","severity":null,"published_at":"2026-11-01T04:18:47+00:00","modified_at":"2026-11-01T04:18:47+00:00","first_seen_at":"2026-11-01T04:47:50+00:00","fetched_at":"2026-11-01T04:47:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120197:1275","url":null,"severity":null,"published_at":"2026-11-01T04:49:26+00:00","modified_at":"2026-11-01T04:49:26+00:00","first_seen_at":"2026-11-01T04:49:26+00:00","fetched_at":"2026-11-01T04:49:26+00:00","note":"Only VulDB/CNA entry found (VDB-429560); no WAVLINK advisory or fix located; PoC on GitHub per VulDB (link not public in page). CVSS vector has PR:L so login likely required; triage's 'without logging in' removed. Not exploited per sources."}],"documents":[{"id":36889,"url":"https://vuldb.com/vuln/429560","title":"VDB-429560 WAVLINK WL-WN530HG4B wapi.cgi port_forward OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}