CVE-2026-120195 is a critical OS command injection flaw in the Initial Setup Wizard of the WAVLINK WL-WN579A3-A, reachable remotely without authentication, and a public exploit has been disclosed.
What Is It
The flaw is in the set_wzdgwMesh function of /cgi-bin/adm.cgi, which belongs to the device's Initial Setup Wizard component. If an attacker manipulates the wlan_ssid argument, the device runs OS commands of the attacker's choosing. The CNA (VulDB) classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The NVD record was published on 2026-11-01 and has a status of "Received." This means NVD has not yet completed its own analysis. All scoring and descriptive data below comes from the CNA.
Why It Matters
The CNA scores this vulnerability at the top of the scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The vectors describe an attack sent over the network, with low complexity, no privileges and no user interaction. The impact on confidentiality, integrity and availability is high. The CVSS 3.1 scope is "Changed," meaning a successful attack can affect resources beyond the vulnerable component.
According to the record, the exploit has been publicly disclosed and may be used. A proof-of-concept write-up is listed in the references.
KEV status: CVE-2026-120195 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. A public exploit exists, but KEV does not confirm active exploitation in the wild at this time.
What's Vulnerable
- Vendor: WAVLINK
- Product: WL-WN579A3-A
- Affected version: 2026-03-10-94f93d4
- Component: Initial Setup Wizard (
/cgi-bin/adm.cgi, functionset_wzdgwMesh) - CPE:
cpe:2.3:a:wavlink:wl-wn579a3-a:*:*:*:*:*:*:*:*
No other versions are listed as affected in the supplied data.
Patch Status
The supplied data does not mention a vendor patch, fixed version or advisory. The record says the vendor was contacted early about the disclosure but does not record a vendor response. There is no CISA KEV entry, so no federal required action or due date applies. Owners of affected devices should watch WAVLINK for firmware updates and refer to the references below for the latest status.