CVE-2026-120197: WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection

Published Nov 1, 2026

Updated

A flaw has been found in WAVLINK WL-WN530HG4B MV260724. This impacts the function portforward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via MITRE·03:45 AM

Data Sourced

via MITRE·03:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected product identified is WAVLINK WL-WN530HG4B running M_V260724. The vulnerable functionality is the port_forward handler in /cgi-bin/wapi.cgi.

What access does an attacker need to exploit it?

The attack can be initiated remotely over the network and does not require user interaction. The severity vector indicates that the attacker needs low-level privileges before exploitation.

What input is involved in the injection?

The vulnerable argument is Name in the port_forward functionality. Manipulating this argument can result in operating-system command injection.

Is exploitation known to be practical?

An exploit has been published and may be used. This increases the likelihood that attackers can attempt exploitation where the affected interface is reachable.

CVE-2026-120197: WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What input is involved in the injection?

Is exploitation known to be practical?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What input is involved in the injection?

Is exploitation known to be practical?