Overview
CVE-2026-120197 is a critical OS command injection in the WAVLINK WL-WN530HG4B, firmware M_V260724. The port_forward function of /cgi-bin/wapi.cgi mishandles the Name argument, allowing OS commands to be injected. NVD states the attack may be performed remotely, that the exploit has been published and may be used, and that the vendor was contacted early but did not respond.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-120197 |
| Severity | Critical |
| CVSS Score | 9.9 |
| Weakness | OS command injection |
| Affected component | /cgi-bin/wapi.cgi — port_forward |
| Vulnerable parameter | Name |
| Attack vector | Remote |
| Exploit status | Public exploit available |
| Published | 2026-11-01 |
Impact
With a public exploit available, opportunistic scanning of exposed WAVLINK devices is likely. Successful exploitation can give an attacker command execution on the router, enabling traffic interception, DNS manipulation, lateral movement, and botnet enrollment.
This is the same port_forward / Name flaw pattern seen in CVE-2026-120196 and CVE-2026-120195, affecting a different WAVLINK model. See also CVE-2026-120198.
Remediation
- Check WAVLINK for fixed firmware for the WL-WN530HG4B and apply it when available.
- Disable remote management and keep the web interface off the internet.
- Restrict access to the admin interface to trusted LAN hosts only, and review port-forwarding rules for unexpected entries.
- Replace the device if no fix is released.