---
id: "CVE-2026-120197"
kind: "vulnerability"
aliases: ["CVE-2026-120197"]
title: "WAVLINK WL-WN530HG4B router: remote command injection via port forwarding"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WL-WN530HG4B", "fixed": [], "affected": "M_V260724", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cgi", "home-router", "infrastructure", "poc-public", "wavlink", "wl-wn530hg4b"]
not_affected_if: ["different-model", "no-firmware-m_v260724"]
published_at: "2026-11-01T04:18:47+00:00"
first_seen_at: "2026-11-01T04:47:50+00:00"
updated_at: "2026-11-01T04:49:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120197", "first_seen_at": "2026-11-01T04:47:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T04:49:26+00:00"}]
---

# WAVLINK WL-WN530HG4B router: remote command injection via port forwarding

The port_forward function of /cgi-bin/wapi.cgi in WAVLINK WL-WN530HG4B firmware M_V260724 passes the Name argument into an operating system command. VulDB says it can be attacked remotely and a proof-of-concept exploit is public. The CVSS vector lists low privileges required, so a login to the router is probably needed; the sources do not say this outright. VulDB says the vendor was contacted and knows of no countermeasure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WL-WN530HG4B affected M_V260724 fixed ?

## How to check

- Open the router admin page and read the firmware version; M_V260724 on a WL-WN530HG4B is the affected one.
- Check whether the admin interface (and /cgi-bin/wapi.cgi) answers from the WAN side; if so, turn off remote administration.
- Check the port forwarding entries for odd Name values containing shell characters.

## Fix

No fix known: VulDB lists no countermeasure and no WAVLINK advisory was found. Turn off WAN-side administration, change the admin password, or replace the device.

## Timeline

- 2026-11-01T04:47:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120197
- 2026-11-01T04:49:26+00:00 analyst — Only VulDB/CNA entry found (VDB-429560); no WAVLINK advisory or fix located; PoC on GitHub per VulDB (link not public in page). CVSS vector has PR:L so login likely required; triage's 'without logging in' removed. Not exploited per sources.

## Documents

- [advisory] VDB-429560 WAVLINK WL-WN530HG4B wapi.cgi port_forward OS command injection https://vuldb.com/vuln/429560

## From the sources

A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_