CVE-2026-120196

Name of the Vulnerable Software and Affected Versions WAVLINK WN579X3-D version V250402

Description A remote attacker can perform OS command injection, which allows the execution of arbitrary operating system commands and potentially grants full control over the device. This issue occurs within the port forward() function of the '/cgi-bin/wapi.cgi' endpoint when the Name parameter is manipulated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/wapi.cgi' endpoint to minimize the risk of exploitation.