SECURITYCRITICALCVE-2026-120196

CVE-2026-120196: WAVLINK WN579X3-D port_forward Command Injection

A critical OS command injection in the port_forward function of the WAVLINK WN579X3-D is remotely exploitable and a public exploit exists. CVSS 9.9.

Dylan H.

Security Team

November 1, 2026
2 min read
CVE-2026-120196: WAVLINK WN579X3-D port_forward Command Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • WAVLINK WN579X3-D — firmware V250402

Overview

CVE-2026-120196 is a critical OS command injection in the WAVLINK WN579X3-D, firmware V250402. The port_forward function of /cgi-bin/wapi.cgi mishandles the Name argument, allowing OS commands to be injected. NVD states the attack may be performed remotely and that the exploit is now public and may be used.

Technical Details

FieldValue
CVE IDCVE-2026-120196
SeverityCritical
CVSS Score9.9
WeaknessOS command injection
Affected component/cgi-bin/wapi.cgi — port_forward
Vulnerable parameterName
Attack vectorRemote
Exploit statusPublic exploit available
Published2026-11-01

Impact

With a public exploit available, opportunistic scanning of exposed WAVLINK devices is likely. Successful exploitation can give an attacker command execution on the router, enabling traffic interception, DNS manipulation, lateral movement, and botnet enrollment.

This is the same product family as CVE-2026-120195 and the earlier CVE-2026-89010.

Remediation

  1. Check WAVLINK for fixed firmware for the WN579X3-D and apply it when available.
  2. Disable remote management and keep the web interface off the internet.
  3. Restrict access to the admin interface to trusted LAN hosts only, and review port-forwarding rules for unexpected entries.
  4. Replace the device if no fix is released.

References