CVE-2026-120197 is a critical (CVSS 3.1: 9.9) OS command injection flaw in WAVLINK WL-WN530HG4B firmware M_V260724; it can be exploited remotely and a public exploit has been released.
What Is It
The flaw is in the port_forward function of /cgi-bin/wapi.cgi on the WAVLINK WL-WN530HG4B. If an attacker manipulates the Name argument, they can inject OS commands. The weaknesses are classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB (the CNA) published the record on 2026-11-01. The NVD status is currently "Received", which means NVD has not yet completed its own analysis.
Why It Matters
- Remote attack: The attack vector is Network, attack complexity is Low, and no user interaction is required.
- Low privileges required: The CVSS vectors require low privileges (CVSS v2: single authentication). The attacker needs some level of access, but not admin rights.
- Scope changed: The CVSS 3.1 vector (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change, with high impact to confidentiality, integrity and availability. - Public exploit: The CNA states that "the exploit has been published and may be used." The CVSS 4.0 exploit maturity is rated Proof-of-Concept.
Scores from the CNA: - CVSS 3.1: 9.9 CRITICAL (Primary) - CVSS 4.0: 8.6 HIGH - CVSS 2.0: 9.0 HIGH
KEV status: No CISA KEV entry was supplied for this CVE. CISA has not confirmed active exploitation in the wild, and no KEV due date or required action applies right now.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| WAVLINK | WL-WN530HG4B | M_V260724 |
The CPE listed is cpe:2.3:a:wavlink:wl-wn530hg4b:*:*:*:*:*:*:*:*. The vulnerable component is the /cgi-bin/wapi.cgi endpoint, specifically its port_forward function.
Patch Status
The supplied sources do not mention a fixed firmware version or vendor advisory. The CNA says the vendor "was contacted early about this disclosure," but the record does not include a vendor response.
Until a fix is confirmed, owners of affected devices should:
- Keep the management interface (/cgi-bin/wapi.cgi) off untrusted networks.
- Restrict who holds device credentials, because exploitation requires low privileges.
- Watch WAVLINK and VulDB for an updated firmware release.