CVE-2026-120197
OS Command Injection in WAVLINK WL-WN530HG4B M_V260724
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
OS command injection in port_forward function of /cgi-bin/wapi.cgi allows manipulation of Name argument. Remote unauthenticated attackers can trigger it over the network. This leads to arbitrary code execution on the router. Affected is WAVLINK WL-WN530HG4B M_V260724.
What to do: Upgrade WAVLINK WL-WN530HG4B to patched firmware. No workaround provided.
| Product | Affected |
|---|---|
| WAVLINK WL-WN530HG4B | M_V260724 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
- Weakness
- CWE-77, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.