Description
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote OS command execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the port_forward function of /cgi-bin/wapi.cgi allows an attacker to craft a Name parameter that is unsanitized and executed by the router’s operating system shell. This results in arbitrary command execution from a remote client, exposing the device to full control over its operating system and network stack. The weakness maps to CWE‑77 (Path Manipulation) and CWE‑78 (OS Command Injection). An attacker could steal credentials, install malware, or disrupt service.

Affected Systems

The vulnerability is limited to WAVLINK routers running the WN579X3‑D model with firmware version V250402. No other WAVLINK models or firmware revisions are listed as affected.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. EPSS data is unavailable, but the exploit has already been published and can be used remotely via standard HTTP requests. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers can trigger the flaw from outside the local network by sending a crafted request to the port_forward endpoint, which is likely exposed by default on WAN interfaces.

Generated by OpenCVE AI on November 1, 2026 at 04:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WN579X3‑D firmware to the latest version that addresses the OS command injection in wapi.cgi.
  • If a firmware upgrade is not immediately possible, block or disable access to /cgi-bin/wapi.cgi on the router’s WAN interface to prevent remote exploitation.
  • Restrict remote management or port forwarding functionality at the network perimeter, or disable the port_forward feature within the router’s configuration if the router’s interface allows it.

Generated by OpenCVE AI on November 1, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN579X3-D wapi.cgi port_forward os command injection
First Time appeared Wavlink
Wavlink wn579x3-d
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wn579x3-d:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn579x3-d
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn579x3-d
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T03:30:24.626Z

Reserved: 2026-10-31T11:43:36.034Z

Link: CVE-2026-120196

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T04:18:46.943

Modified: 2026-11-01T04:18:46.943

Link: CVE-2026-120196

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T04:30:11Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')