Overview
CVE-2026-120195 is a critical OS command injection vulnerability in the WAVLINK WL-WN579A3-A, build 2026-03-10-94f93d4. The flaw is in the set_wzdgwMesh function of /cgi-bin/adm.cgi, part of the Initial Setup Wizard. Manipulating the wlan_ssid argument leads to OS command injection, and NVD notes the attack is possible remotely.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-120195 |
| Severity | Critical |
| CVSS Score | 10.0 |
| Weakness | OS command injection |
| Affected component | /cgi-bin/adm.cgi — set_wzdgwMesh (Initial Setup Wizard) |
| Vulnerable parameter | wlan_ssid |
| Attack vector | Remote |
| Published | 2026-11-01 |
User-supplied SSID data is passed into a shell command without sufficient sanitization, so shell metacharacters in wlan_ssid can execute arbitrary commands on the device.
Impact
- Command execution on the router, typically with elevated privileges on embedded firmware
- Traffic interception, DNS tampering, and use as a pivot into the internal network
- Potential recruitment into a botnet
WAVLINK devices have had several recent command-injection advisories, including CVE-2026-89010. See also the companion advisory CVE-2026-120196.
Remediation
- Check WAVLINK's support page for updated firmware for the WL-WN579A3-A and apply it as soon as one is available.
- Disable remote administration and restrict the web interface to trusted LAN hosts.
- Do not expose the router's management interface to the internet.
- Replace the device if the vendor does not provide a fix.