On this page (8 sections)
A critical vulnerability, tracked as CVE-2026-120195, has been published for the WAVLINK WL-WN579A3-A, a network device with a web-based setup wizard. According to the GitHub Advisory Database entry, the flaw allows OS command injection through a parameter called wlan_ssid, and it can be reached remotely.
If you run this device, manage one for a client, or host equipment on a network where one is installed, this is worth acting on today. The advisory states that an exploit has been disclosed publicly and may be used, and it lists no patched version.
At a glance
What was disclosed
The advisory describes the problem in the function set_wzdgwMesh of the file /cgi-bin/adm.cgi, part of the Initial Setup Wizard component. Manipulating the wlan_ssid argument leads to OS command injection. The text says the attack can be carried out remotely, that the exploit has been disclosed publicly, and that the vendor was contacted early about the disclosure.
The weaknesses are classed as CWE-77 and CWE-78, both forms of command injection. The record was published on November 1, 2026. A public write-up is referenced from the advisory on GitHub, with further entries on VulDB. The NVD entry repeats the same text, so it is not separate confirmation.
Why command injection on a network device is serious
OS command injection happens when a program builds a system command using input a user supplies, without strictly limiting what that input can contain. If the input is not handled safely, the device's operating system may run instructions the attacker chose, rather than just treating the value as a harmless name.
Here the input is an SSID, the name of a Wi-Fi network. It is the kind of field people expect to be plain text, which is why it is easy to overlook when code passes it to a shell. The CVSS v4 metrics in the advisory rate the issue as network-reachable, low complexity, needing no privileges and no user interaction, with high impact on confidentiality, integrity and availability, for both the vulnerable system and subsequent systems.
In practical terms, that profile describes a flaw where someone who can reach the interface may be able to take control of the device. What an attacker would then do depends on the device and the network around it, and the research does not describe specific attacks or any observed abuse.
Who is realistically exposed
- Devices running the firmware version named in the advisory, WL-WN579A3-A 2026-03-10-94f93d4. Other builds may or may not be affected; the advisory does not say.
- Devices whose web management interface is reachable from the internet, for example through port forwarding or a remote administration setting.
- Devices on shared or guest networks, where other users can reach the interface from inside the local network.
- Small offices, remote sites and client locations where the device was installed once and rarely revisited.
How to check your exposure
Start with an inventory. Find out whether any WL-WN579A3-A units exist on networks you manage, then check the firmware version in the device's admin page and compare it with the version named above.
Next, check whether the admin interface is reachable from outside. From a machine outside your network (for example a mobile connection), see whether the device's public IP answers on its web ports. You can also review your router or firewall rules for port forwards that point at the device. Only test addresses you own or administer.
Finally, look at the device and surrounding logs for anything unusual. This research does not describe indicators of compromise, so the signs to watch for are general ones: unexpected configuration changes, an SSID you did not set, unfamiliar admin accounts, odd outbound connections, or the device rebooting or slowing without reason.
What to do now
The research lists no fixed version, so the priority is reducing exposure while you wait for vendor guidance. Do not assume a fix exists until WAVLINK publishes one.
0 of 8 done
Monitoring afterwards
Watch the GitHub advisory and the VulDB entry for updates, since the record currently shows affected and patched versions as unknown. If the story changes, for example a vendor fix or reports of exploitation, those are the places likely to reflect it first.
For websites and services hosted behind or alongside this kind of device, the Webforta Monitor service can alert you to uptime, certificate and DNS changes, which can help you notice when something on the network path stops behaving normally. It does not detect or fix this specific flaw. For broader background on checking a compromised site, see how to check if a website is hacked.
What is still unknown
- Whether WAVLINK has released a fixed firmware version, and which versions are affected beyond the one named.
- Whether the flaw has been exploited in the wild. Only one independent publisher covers this so far, and the research shows no CISA KEV listing.
- Whether authentication or a particular device state limits real-world exploitation.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.