Description
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote OS command injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the port_forward function of the /cgi-bin/wapi.cgi CGI script of WAVLINK WL‑WN530HG4B routers enables attackers to inject operating‑system commands via the Name parameter, allowing arbitrary code execution on the device. This flaw can compromise confidentiality, integrity, and availability, potentially giving an attacker full control of the router. The weakness is a classic command‑injection vulnerability (CWE‑77 and CWE‑78).

Affected Systems

The vulnerability is limited to WAVLINK WL‑WN530HG4B routers with firmware build M_V260724. No other vendors or products are affected at this time.

Risk and Exploitability

The CVSS score of 9.4 marks this as a critical flaw. The EPSS score is not available, so the exploitation probability cannot be quantified, but the published exploit indicates that attacks are feasible. The flaw is not listed in CISA’s KEV catalog yet, but the remote nature of the attack (sending a crafted request to the CGI endpoint) means that any exposed router could be compromised by an attacker on the WAN or local network.

Generated by OpenCVE AI on November 1, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest WAVLINK firmware update that resolves the command injection flaw in the port_forward function.
  • If a patched firmware is not available, block external access to the router’s web interface and specifically deny traffic to /cgi-bin/wapi.cgi from outside the local network.
  • Restrict router management to local‑only IP addresses or disable remote configuration over the WAN.
  • Monitor device logs for any requests to /cgi-bin/wapi.cgi containing the Name parameter that includes shell characters such as backticks or semicolons.

Generated by OpenCVE AI on November 1, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 04:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
First Time appeared Wavlink
Wavlink wl-wn530hg4b
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wl-wn530hg4b:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn530hg4b
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wl-wn530hg4b
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T03:45:22.184Z

Reserved: 2026-10-31T11:43:47.613Z

Link: CVE-2026-120197

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T04:18:47.147

Modified: 2026-11-01T04:18:47.147

Link: CVE-2026-120197

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T05:30:16Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')