CVE-2026-120196: critical vulnerability in WAVLINK WN579X3-D
WAVLINK WN579X3-D wapi.cgi port_forward os command injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 1.7%
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
WAVLINK · WN579X3-Dpublic PoCs found — 1
cve_referencegithub.com/pipiyyb/cve/blob/main/WN579X3-D(en).mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.