EUVD-2026-114769
GHSA-jq5g-pp5w-q8h6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface
-
DeliverySend crafted wapi.cgi port_forward request
-
ExploitInject shell metacharacters via Name argument
-
ExecutionFirmware executes injected OS command
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the port_forward handler of /cgi-bin/wapi.cgi, triggered by injecting shell metacharacters into the Name argument of a port-forwarding configuration request. The CVSS vector's PR:L means the attacker needs a level of authenticated/privileged access to the router management interface - this is the primary limiting factor, confining practical exploitation to attackers who can reach and authenticate to (or already have a foothold on) the device's web interface, rather than fully unauthenticated internet-wide attack. The attack is network-based with low complexity and no user interaction once access is obtained. Specific affected build is firmware M_V260724 of the WL-WN530HG4B; no fixed version is provided in the available sources. |
| Impact | This is a CWE-78 OS command injection in the WAVLINK WL-WN530HG4B router firmware (M_V260724), reachable over the network via the port_forward function in /cgi-bin/wapi.cgi. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack that nonetheless requires some privilege level (PR:L) - i.e. authentication is required per the vector, not an unauthenticated flaw. The claimed impact is total (VC:H/VI:H/VA:H), consistent with command execution on an embedded device. Weighing the signals: the vuln.today Decision label is 'this_week' (not act_now/emergency); there is no CISA KEV listing and no EPSS score provided; the only exploit signal is a GitHub reference marked as a PoC that is NOT verified as working exploit code. So the picture is a genuinely serious bug class (command injection, full device compromise) but with a tempering factor - exploitation requires valid credentials/privilege (PR:L), and real-world exploitation is not confirmed. The 8.6 score is driven largely by the high impact and network vector; the PR:L requirement and unverified PoC pull real-world urgency down to 'investigate and patch this week' rather than drop-everything. Note the input's 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) appear inflated for a self-contained device compromise; see assessed vector. |
| Exploit ScenarioDerived | An attacker with access to the router's web management interface (the vector requires PR:L, i.e. some authentication/privilege) sends a crafted request to /cgi-bin/wapi.cgi invoking the port_forward function with a malicious Name argument, injecting shell metacharacters that the firmware passes to an OS command. The injected command executes on the device, typically with high privilege, yielding full control of the router. A public PoC reference exists at github.com/pipiyyb/cve, but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
OS command injection in the port_forward handler of the WAVLINK WL-WN530HG4B router's web management CGI (/cgi-bin/wapi.cgi) allows an attacker who can reach and authenticate to the device's administrative interface to run arbitrary shell commands on the firmware by placing shell metacharacters in the Name argument of a port-forwarding configuration request. The issue affects firmware build M_V260724 and carries a CVSS 4.0 base score of 8.6, with high confidentiality, integrity and availability impact; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the PR:L prerequisite, meaning the practical bar is authenticated access to the management UI rather than a fully unauthenticated internet-wide attack. A public PoC reference has been published in a GitHub write-up, but it is not verified as working exploit code, and no CISA KEV listing or EPSS score is available at time of analysis.
Earlier versions of this analysis (1)
OS command injection in the WAVLINK WL-WN530HG4B wireless router running firmware M_V260724 lets an authenticated, low-privileged attacker who can reach the device's web management interface run arbitrary operating system commands by supplying a crafted 'Name' value to the port_forward function in /cgi-bin/wapi.cgi, with high impact on confidentiality, integrity and availability of the device. A public PoC reference exists (a GitHub write-up); it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Exploitation is not possible from the WAN in a default deployment - the management UI sits on the LAN - but the attack surface widens sharply if that interface is exposed, and the vulnerability currently carries an act_now priority with no vendor-released fixed firmware version identified.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available sources for the WL-WN530HG4B, so the primary action is to confirm with WAVLINK whether a corrected build exists for M_V260724 and apply it if published, tracking the VulDB record at https://vuldb.com/vuln/429560 for updates. Until a fix is documented, reduce exposure by removing the router's web management interface from any WAN-facing or port-forwarded path and restricting /cgi-bin/wapi.cgi to trusted LAN or VPN segments via firewall ACLs, accepting that this breaks remote administration and requires on-site or tunneled access. Rotate administrative credentials and audit for default or shared passwords, since the PR:L prerequisite means an attacker needs a working authenticated session to reach the vulnerable handler; the trade-off is operational overhead in managing credentials across devices. Where the management UI cannot be segmented, place the device behind a reverse proxy or jump host that enforces authentication and logging of requests to wapi.cgi, and monitor for unexpected outbound connections or processes originating from the router, which may indicate command injection has succeeded.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-78 OS command injection in the CGI-based web management layer of an embedded router. WAVLINK's wapi.cgi exposes handler functions that back the device's administrative UI, and the port_forward function processes a port-forwarding configuration request whose Name parameter is passed into a shell invocation without adequate neutralization of shell metacharacters, so crafted input is interpreted by the command interpreter rather than treated as inert configuration data. Because the handler lives in the device's management CGI, reachability of the HTTP interface is the gate on exposure, and the assessed PR:L metric means an attacker must hold some level of authenticated/privileged session on that interface (obtained directly, by credential reuse/default credentials, or via an existing foothold) before the injected command executes. The trigger, as reported, is manipulation of the Name argument of a port-forwarding request submitted to /cgi-bin/wapi.cgi; other parameters or handlers of wapi.cgi are not described as affected in the available sources. The CPE cpe:2.3:a:wavlink:wl-wn530hg4b:*:*:*:*:*:*:*: covers the WL-WN530HG4B hardware line, with the reported vulnerable firmware build being M_V260724.
Know when Wl Wn530Hg4B gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable command injection on wapi.cgi with low complexity but requiring authentication (PR:L); command execution yields full device compromise (C/I/A:H), impact contained to the router (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78 (OS Command Injection) in the portforward handler of /cgi-bin/wapi.cgi on the WAVLINK WL-WN530HG4B, firmware MV260724.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-120197 is a high-severity OS command injection vulnerability in the WAVLINK WL-WN530HG4B router's web management interface (firmware M_V260724). Successful exploitation lets an authenticated attacker execute arbitrary shell commands, compromising the device's confidentiality, integrity, and availability. As these routers are typically deployed at network edges, compromise could enable attackers to pivot into internal networks, making this a significant risk for organizations relying on this model for connectivity.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative interface access to a dedicated management VLAN or trusted IP ranges, disable remote management on the WAN, enforce strong authentication, and monitor for suspicious activity. Consider replacing affected devices with supported alternatives if a patch is not available in a timely manner.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB