WAVLINK router firmware contains two newly disclosed command-injection vulnerabilities, including one that can be exploited remotely without authentication, according to newly published CVE records. The flaws affect the WL-WN579A3-A and WL-WN530HG4B models, and the disclosures say exploit code has been made public.
The more severe issue, tracked as CVE-2026-120195, affects the WAVLINK WL-WN579A3-A running firmware build 2026-03-10-94f93d4. The flaw is in the router’s Initial Setup Wizard, where the set_wzdgwMesh function in /cgi-bin/adm.cgi mishandles the wlan_ssid parameter, allowing an unauthenticated remote attacker to inject operating-system commands. The CVE record assigns it a CVSS 3.1 score of 10.0.
A second vulnerability, CVE-2026-120197, affects the WL-WN530HG4B running firmware M_V260724. It involves command injection through the Name argument in the port_forward function in /cgi-bin/wapi.cgi. The attack is remote but requires low-level privileges, and the CVE record gives it a CVSS 3.1 score of 9.9.
Both disclosures are credited to researcher hackerpipi and the VulDB CNA team. The records say WAVLINK was contacted, and link to public technical write-ups. At the time of reporting, the vulnerability records did not list a vendor security advisory or fixed firmware version.
The disclosures add to recent reporting on router security, including a Broadcom Wi-Fi flaw that enabled router takeover without a password and critical vulnerabilities in Acer Wave 7 mesh routers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
