{"id":"CVE-2026-120196","published":"2026-11-01T04:18:46.943","lastModified":"2026-11-01T04:18:46.943","description":"A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120196","tags":[]},{"url":"https://vuldb.com/submit/916941","tags":[]},{"url":"https://vuldb.com/vuln/429559","tags":[]},{"url":"https://vuldb.com/vuln/429559/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote command injection flaw exists in the WAVLINK WN579X3-D V250402 router's port_forward function via the Name parameter in /cgi-bin/wapi.cgi, allowing unauthenticated attackers to execute arbitrary OS commands.","exploitability":"Exploitation requires low privileges (authenticated user) and no user interaction; the exploit is publicly available, making exploitation trivial for attackers with network access.","blast_radius":"Successful exploitation grants full system compromise—confidentiality, integrity, and availability impacts—potentially enabling complete router takeover, lateral movement, or persistent backdoor deployment within the internal network.","remediation":"Upgrade to firmware version 2.590 or later, as the vendor has released a patched version; if unavailable, disable port forwarding functionality and restrict access to /cgi-bin/wapi.cgi via firewall rules until patched.","detection":"Look for HTTP POST requests to /cgi-bin/wapi.cgi with suspicious Name parameter values containing shell metacharacters (e.g., ;, |, $(), backticks) or known command injection payloads in web server logs; also monitor for unexpected outbound connections or new processes spawned by the router's web service.","tags":["rce","command-injection","web","router","firmware"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:46:01.072Z"}}