CVE-2026-120195
OS Command Injection in WAVLINK WL-WN579A3-A Router
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
OS command injection occurs in set_wzdgwMesh of adm.cgi when manipulating wlan_ssid. It is triggered remotely without authentication or user interaction. Exploitation allows arbitrary code execution, affecting users of the WAVLINK WL-WN579A3-A router.
What to do: Apply WAVLINK's update for CVE-2026-120195
| Product | Affected |
|---|---|
| WAVLINK WL-WN579A3-A | 2026-03-10-94f93d4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
- Weakness
- CWE-77, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.