CVE-2026-120196 is a critical, remotely exploitable OS command injection in the port_forward function of WAVLINK WN579X3-D firmware V250402, and a public exploit is available.
What Is It
CVE-2026-120196 is in the port_forward function of /cgi-bin/wapi.cgi on the WAVLINK WN579X3-D. An attacker can tamper with the Name argument to inject operating system commands. The record lists the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB, the CNA, published the record on 2026-11-01. NVD lists its status as "Received," so NVD has not yet analyzed it.
Why It Matters
VulDB scores this CVSS 3.1 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That means:
- Remote attack: it works over the network with low attack complexity.
- Low privileges needed: the attacker needs only low-level privileges, and no user has to interact.
- Changed scope: the impact reaches beyond the vulnerable component, with high impact to confidentiality, integrity and availability.
The CVSS 4.0 score is 8.6 (High), with exploit maturity rated Proof-of-Concept. CVSS 2.0 scores it 9.0.
The NVD description says "the exploit is now public and may be used." Exploit details are publicly available, which raises the risk for exposed devices.
KEV status: No CISA Known Exploited Vulnerabilities entry was supplied for this CVE. KEV does not confirm active exploitation in the wild at this time, and no KEV-mandated remediation deadline applies.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN579X3-D
- Affected version: V250402
- Component:
/cgi-bin/wapi.cgi, functionport_forward, parameterName - CPE:
cpe:2.3:a:wavlink:wn579x3-d:*:*:*:*:*:*:*:*
The supplied data does not say whether other firmware versions are affected.
Patch Status
The supplied sources contain no information about a vendor patch, fixed firmware version or official advisory. The disclosure notes only that "the vendor was contacted early about this disclosure." It does not say whether the vendor responded or released a fix.
With no confirmed fix, owners of WN579X3-D devices on V250402 should check WAVLINK's channels for updated firmware. They should also limit who can reach the device's web management interface, since the attack is remote and needs only low privileges.