Vulnerability · Published Nov 1, 2026 · Assigned by VulDB
CVE-2026-120197WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
Critical 9.9
In plain English
A critical-severity OS command injection in WL-WN530HG4B from WAVLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAVLINK | WL-WN530HG4B | M_V260724 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-429560 | WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection vdb-entry, technical-description
- VDB-429560 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-120197 | CVE Analysis and Report third-party-advisory
- Submit #917074 | WAVLINK WL-WN530HG4B M_V260724 CWE-78 third-party-advisory
- https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md exploit