CVE-2026-120197

CRITICAL 9.9

WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CWE	CWE-78 CWE-77
Vendor	wavlink
Product	wl-wn530hg4b
Published	Nov 1, 2026

Stay Ahead of the Next One

Get instant alerts for wavlink wl-wn530hg4b

Be the first to know when new critical vulnerabilities affecting wavlink wl-wn530hg4b are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

WAVLINK / WL-WN530HG4B

M_V260724

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429560 vuldb.com: https://vuldb.com/vuln/429560/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120197 vuldb.com: https://vuldb.com/submit/917074 github.com: https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md

Credits

🔍 hackerpipi (VulDB User) VulDB CNA Team