EUVD-2026-114768
GHSA-fmc2-w58f-qqpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web UI as low-privileged user
-
DeliverySubmit port_forward request to /cgi-bin/wapi.cgi
-
ExploitInject shell metacharacters via Name argument
-
ExecutionOS command executes on device
-
ImpactFull device compromise and traffic control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the device's web management interface (/cgi-bin/wapi.cgi) and invoke the port_forward function, supplying a malicious 'Name' argument - the port-forwarding configuration feature is the exact attack surface. The CVSS vector's PR:L indicates a low-privilege authenticated session to that interface is required, which is the primary limiting factor: this is not a fully unauthenticated attack. Realistic exposure increases significantly where the management interface is reachable from the WAN or where default/weak credentials are in use; it is limited to the WAVLINK WN579X3-D (reported at firmware V250402). The precise injection trigger beyond the Name argument is not further detailed in the available sources. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full high impact to the vulnerable system (VC:H/VI:H/VA:H) describes a remotely reachable, low-complexity OS command injection (CWE-78) in the WAVLINK WN579X3-D web management interface (/cgi-bin/wapi.cgi, port_forward function). The PR:L metric indicates authentication is required - exploitation is not fully unauthenticated. Exploitation status: a public PoC reference exists (GitHub pipiyyb/cve), but it is not verified as working exploit code, and there is no CISA KEV listing, so this is not confirmed active exploitation. The EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be factored in. SSVC/decision signal from vuln.today is 'this_week' priority (E:P, PoC-stage), which places it as a near-term patch item rather than an emergency. The subsequent-system impact flags (SC:H/SI:H/SA:H) in the vendor 4.0 vector appear aggressive for a self-contained command injection on the device OS and are not corroborated by any described scope change in the sources. Net: a genuinely serious device-takeover bug on affected hardware, but tempered by the authentication requirement, unverified exploit code, and absence of KEV/EPSS confirmation. |
| Exploit ScenarioDerived | An attacker with access to the router's web interface (PR:L) sends a crafted request to /cgi-bin/wapi.cgi invoking the port_forward function with a malicious 'Name' argument that embeds shell metacharacters, causing the injected OS command to execute on the device. A public PoC reference exists but is not verified as working exploit code; successful exploitation yields arbitrary command execution on the router with full control of its traffic and configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
OS command injection (CWE-78) in the WAVLINK WN579X3-D wireless router (reported at firmware V250402) lets an attacker who can reach the web management interface execute arbitrary shell commands on the device by supplying a crafted 'Name' argument to the port_forward function of /cgi-bin/wapi.cgi. The vendor's CVSS 4.0 vector scores this 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), and the parallel assessment confirms remote reachability with low attack complexity but requires a low-privilege authenticated session on the management interface, so this is not a fully unauthenticated attack; exposure rises sharply where the admin interface is reachable from the WAN or default/weak credentials remain in place. A public PoC reference exists (a GitHub write-up linked from the VulDB entry) but has not been verified as working exploit code, and no confirmed active exploitation (CISA KEV) has been reported. Successful exploitation gives full control of the device's configuration and the traffic it forwards.
Earlier versions of this analysis (1)
OS command injection in the WAVLINK WN579X3-D router (firmware V250402) lets a remote, low-privilege authenticated user execute arbitrary shell commands on the device by supplying a crafted Name argument to the port_forward function of /cgi-bin/wapi.cgi. Successful exploitation yields full compromise of the router's confidentiality, integrity and availability, and because the router's web backend typically runs with elevated privileges, the blast radius can extend to connected network segments (the CVSS 4.0 score of 9.4 and our assessed CVSS 3.1 vector both reflect scope change). A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) has been reported, but the assigned priority is act_now given the severity, the low attack complexity and the fact that default or weak administrative credentials on consumer routers can effectively reduce the PR:L barrier. The vendor was contacted prior to disclosure; no fixed firmware version appears in the available intelligence.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data: the vendor was contacted early about the disclosure, but no advisory with a fix version has been published, so the status is no vendor-released patch at time of analysis and users should monitor https://vuldb.com/vuln/429559 and WAVLINK's support channels for a firmware update. Until then, the practical control is to remove the attack surface: disable WAN-side/remote management and UPnP-driven administrative exposure so that /cgi-bin/wapi.cgi is reachable only from the LAN (trade-off: remote administration must be done through a VPN or SSH tunnel), and place the router's management interface behind a firewall ACL restricted to known administrative hosts. Replace default and weak administrator credentials and use unique, strong passwords, since the vector requires a low-privilege authenticated session and credential reuse materially lowers the bar (trade-off: credential rotation across managed devices adds operational overhead). If port forwarding must be configured, do it from a trusted host and avoid untrusted characters in the forwarding rule 'Name' field, and prefer an alternate device or firmware for internet-facing deployments until a fix ships (trade-off: the feature may be replaced by static routes or a downstream firewall performing the same NAT function). Because a public PoC reference exists at https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md, log and review management-interface access for unexpected POSTs to /cgi-bin/wapi.cgi as a detection measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP management service of the WAVLINK WN579X3-D, exposed through the CGI endpoint /cgi-bin/wapi.cgi. The port_forward function handles port-forwarding (virtual server) configuration, and the 'Name' field of that configuration is passed to a shell without adequate sanitisation, which is the classic CWE-78 OS command injection pattern: shell metacharacters embedded in the field are interpreted by the underlying command interpreter rather than treated as inert data. Because the CGI runs with the privileges of the device's web service (typically root on consumer router firmware), a successful injection yields command execution in the device's operating context, which is why the impact metrics are high across confidentiality, integrity and availability. The supplied CPE (cpe:2.3:a:wavlink:wn579x3-d:*:*:*:*:*:*:*:*) is unversioned, so the full set of affected firmware builds is not enumerated in the available data; the specific firmware referenced in the disclosure is V250402. Authentication requirements follow from the CVSS vector's PR:L, meaning a low-privilege session on the management interface is needed; the precise injection trigger beyond manipulation of the Name argument is not described in the available sources.
Know when Wn579X3 D gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remotely reachable web endpoint (AV:N/AC:L), but port-forward configuration requires an authenticated session (PR:L); command injection yields full device OS compromise (C/I/A:H), scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78: OS command injection, authenticated variant, in the portforward handler of /cgi-bin/wapi.cgi on WAVLINK WN579X3-D firmware M79X3D.V250402.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity command injection vulnerability in the WAVLINK WN579X3-D wireless router allows authenticated attackers with access to the management interface to execute arbitrary shell commands. This affects organizations using these routers, particularly if the admin interface is exposed to the internet or protected by weak credentials, potentially leading to full device compromise and lateral movement into the network.
Restrict management interface access to trusted networks (e.g., via firewall rules or VPN), enforce strong administrative credentials, disable WAN-side management if not required, segment affected devices on isolated VLANs, and monitor for anomalous command execution or unauthorized configuration changes.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB