WAVLINK WL-WN579A3-A CVE-2026-120195

The attacker must be able to reach the device's HTTP management interface and send a request to /cgi-bin/adm.cgi that invokes the set_wzdgwMesh function of the Initial Setup Wizard, supplying a crafted wlan_ssid argument containing shell metacharacters (CWE-78). Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication or user interaction is indicated and default configurations appear affected. The primary limiting factor is network exposure of the management interface: on consumer devices this web panel is normally LAN-side, so internet-wide exploitation depends on whether remote/WAN administration is enabled or the device is otherwise exposed. The exact mechanism by which wlan_ssid reaches the command interpreter is not described in the available sources beyond the parameter and function names.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated OS command injection (CWE-78) with full High impact to confidentiality, integrity and availability of both the vulnerable and subsequent systems, scoring 9.3. The vuln.today Decision label is act_now, and the exploit maturity in the vector is E:P (proof-of-concept), consistent with the input noting a public exploit reference. Reinforcing signals: the flaw sits in the device's Initial Setup Wizard (adm.cgi) and yields command execution, which on an embedded router typically means root. Tempering signals and gaps: there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active, widespread exploitation - the priority rests on act_now plus a public PoC reference, not on observed attacks. The PoC is a reference only and is NOT verified as working exploit code, so real-world weaponization is unconfirmed. The sole intelligence source is VulDB; there is no vendor advisory, and the vendor was only 'contacted early.' Net: treat as urgent to remediate where the device's web management interface is reachable, while recognizing exploitation evidence is PoC-stage rather than confirmed in-the-wild.

An attacker with network access to the WL-WN579A3-A web management interface sends a crafted request to /cgi-bin/adm.cgi invoking set_wzdgwMesh with a malicious wlan_ssid value, injecting shell metacharacters that the device executes as OS commands (typically as root on such embedded devices). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is indicated, so a single request can yield command execution. A public PoC reference exists but is not verified as working exploit code, so reliability in practice is unconfirmed.