CVE-2026-120195
Received Received - Intake

OS Command Injection in WAVLINK WL-WN579A3-A

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120195
EUVD
EUVD-2026-114767

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WL-WN579A3-A 2026-03-10-94f93d4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated command injection flaw in the WAVLINK WL-WN579A3-A router. It exists in the set_wzdgwMesh function of the adm.cgi file, specifically when processing the wlan_ssid parameter during the initial setup wizard state. Due to weak input validation, attackers can inject malicious system commands via crafted requests, allowing arbitrary command execution as root.

Detection Guidance

Check if your WAVLINK WL-WN579A3-A router is running firmware version WINSTAR_WN579A3-A-2026-03-10-94f93d4. Verify if the device is in the initial setup state by checking if UserInit=0 and Popup=1. Send a crafted POST request to /cgi-bin/adm.cgi with a test payload in the wlan_ssid parameter to observe if arbitrary command execution occurs.

  • Use curl to test: curl -X POST -d 'wlan_ssid=test;id' http://<router-ip>/cgi-bin/adm.cgi. If the response includes output from the 'id' command, the device is vulnerable.
Impact Analysis

This vulnerability allows attackers to gain full control over the affected WAVLINK router remotely. They can execute arbitrary commands as root, potentially leading to complete device compromise, data theft, or turning the device into a botnet node. The attack is only possible when the device is in the initial setup state.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote access to the admin interface if not required. Disable the initial setup wizard if possible. Block external access to /cgi-bin/adm.cgi via firewall rules. Monitor network traffic for suspicious POST requests to this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart