CVE-2026-120195

Summary

A command injection flaw in WAVLINK WL-WN579A3-A firmware allows unauthenticated remote attackers to execute arbitrary OS commands via the wlan_ssid parameter in the set_wzdgwMesh function of /cgi-bin/adm.cgi, leading to full system compromise.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required; public exploit code exists.

Blast radius

Complete device takeover enabling data exfiltration, lateral movement, and persistent backdoor deployment across the network.

Detection

Unusual outbound connections from the device to external IPs on non-standard ports, or unexpected execution of shell commands logged in system logs (e.g., /var/log/messages or dmesg) containing strings like 'sh', 'bash', or 'nc'.

Prioritized remediation

Upgrade to firmware version 2026-04-15-xxxxxxx (or later) if available; otherwise, disable the Initial Setup Wizard feature and restrict access to /cgi-bin/adm.cgi via firewall rules until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.