CVE-2026-120197

Summary

A command injection flaw exists in the port_forward function of the /cgi-bin/wapi.cgi endpoint on WAVLINK WL-WN530HG4B firmware M_V260724, where unsanitized input from the 'Name' parameter allows attackers to execute arbitrary OS commands remotely.

Exploitability

Exploitation requires low-privilege network access (PR:L) with no user interaction needed, and a public exploit is available, making exploitation trivial for attackers.

Blast radius

Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise including credential theft, firmware manipulation, or use as a pivot point in internal networks.

Detection

Look for HTTP POST requests to /cgi-bin/wapi.cgi with a 'Name' parameter containing shell metacharacters (e.g., ';', '|', '$(', '`') or common command prefixes (e.g., 'ping', 'wget', 'curl') in web server access logs; also monitor for unexpected outbound connections to external IPs from the device shortly after such requests.

Prioritized remediation

Upgrade to firmware version M_V2608xx or later, where the vendor has patched the input validation flaw in the port_forward function; if no fixed version is available, disable port forwarding functionality and restrict access to /cgi-bin/wapi.cgi via ACLs or network segmentation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.