CVE-2026-120196

Summary

A remote command injection flaw exists in the WAVLINK WN579X3-D V250402 router's port_forward function via the Name parameter in /cgi-bin/wapi.cgi, allowing unauthenticated attackers to execute arbitrary OS commands.

Exploitability

Exploitation requires low privileges (authenticated user) and no user interaction; the exploit is publicly available, making exploitation trivial for attackers with network access.

Blast radius

Successful exploitation grants full system compromise—confidentiality, integrity, and availability impacts—potentially enabling complete router takeover, lateral movement, or persistent backdoor deployment within the internal network.

Detection

Look for HTTP POST requests to /cgi-bin/wapi.cgi with suspicious Name parameter values containing shell metacharacters (e.g., ;, |, $(), backticks) or known command injection payloads in web server logs; also monitor for unexpected outbound connections or new processes spawned by the router's web service.

Prioritized remediation

Upgrade to firmware version 2.590 or later, as the vendor has released a patched version; if unavailable, disable port forwarding functionality and restrict access to /cgi-bin/wapi.cgi via firewall rules until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.