{"id":"CVE-2026-120197","published":"2026-11-01T04:18:47.147","lastModified":"2026-11-01T04:18:47.147","description":"A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120197","tags":[]},{"url":"https://vuldb.com/submit/917074","tags":[]},{"url":"https://vuldb.com/vuln/429560","tags":[]},{"url":"https://vuldb.com/vuln/429560/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw exists in the port_forward function of the /cgi-bin/wapi.cgi endpoint on WAVLINK WL-WN530HG4B firmware M_V260724, where unsanitized input from the 'Name' parameter allows attackers to execute arbitrary OS commands remotely.","exploitability":"Exploitation requires low-privilege network access (PR:L) with no user interaction needed, and a public exploit is available, making exploitation trivial for attackers.","blast_radius":"Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise including credential theft, firmware manipulation, or use as a pivot point in internal networks.","remediation":"Upgrade to firmware version M_V2608xx or later, where the vendor has patched the input validation flaw in the port_forward function; if no fixed version is available, disable port forwarding functionality and restrict access to /cgi-bin/wapi.cgi via ACLs or network segmentation.","detection":"Look for HTTP POST requests to /cgi-bin/wapi.cgi with a 'Name' parameter containing shell metacharacters (e.g., ';', '|', '$(', '`') or common command prefixes (e.g., 'ping', 'wget', 'curl') in web server access logs; also monitor for unexpected outbound connections to external IPs from the device shortly after such requests.","tags":["command-injection","os-command","webapp","router","firmware"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:46:12.751Z"}}