On this page (7 sections)
A command injection flaw has been published for the WAVLINK WN579X3-D, version V250402. Tracked as CVE-2026-120196, it sits in the port forwarding function of the router's web CGI interface and can be triggered remotely. The advisory states that the exploit is now public.
If you run this model at an office, a branch site, or as the gateway for a small web server, you should read on. No patched version is listed in the sources we reviewed, so most of the advice below is about reducing exposure.
What was disclosed
According to the GitHub advisory, which mirrors the NVD record, the flaw affects the function port_forward in the file /cgi-bin/wapi.cgi. Manipulating the argument Name results in OS command injection. The attack may be performed remotely, and the exploit is described as public and usable. The record also says the vendor was contacted early about the disclosure.
The NVD entry repeats the same description, so this is effectively one source. Further write-ups are linked from the advisory, including a researcher's write-up on GitHub and a VulDB entry. We have not seen a vendor advisory or a statement about a fix.
Why command injection on a router matters
OS command injection happens when a device builds a system command from input a user supplies, without safely separating data from instructions. If the Name value in a port forwarding rule ends up inside a shell command, a crafted value can make the device run commands the manufacturer never intended.
On a router that usually means control of the device itself. The CVSS v4 metrics in the advisory rate the attack vector as network, complexity as low, no user interaction, and high impact on confidentiality, integrity and availability, for both the vulnerable and subsequent systems. Privileges required are rated low, so some form of login may be needed. The sources do not say which kind of account or how it is obtained.
A compromised gateway can expose or redirect traffic, alter DNS settings, open access to internal hosts, or serve as a foothold for further attacks. These are general consequences of router takeover, not behavior reported for this specific CVE.
Who is realistically exposed
- Owners of a WN579X3-D running firmware V250402. Other versions are not described in the research, so their status is unknown.
- Sites where the router's web management page is reachable from the internet, or from a guest or untrusted network.
- Small offices and home setups hosting a website, camera, or file share behind this router.
Because the sources do not list any fixed release, treat every unit on V250402 as affected until the vendor says otherwise.
How to check your exposure
Start by confirming whether you own the model and which firmware it runs. Log in to the router's admin page from the internal network and look at the status or firmware page for the model name and version string.
Next, check whether the admin interface is reachable from outside. From a machine on a different network (for example a phone on mobile data), try opening the router's public IP address in a browser. If the login page loads, remote management is exposed.
The following port check sends connection probes to the listed ports on one address. Run it from a machine outside your network, and only against a public IP address that you own or are authorized to test. Replace the placeholder with your own address. A result of open for port 80, 443 or 8080 means a web service is reachable from the internet on that address; filtered or closed means it is not.
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IPAlso review any logs the router keeps for unfamiliar port forwarding rules, odd rule names, or settings you did not change, such as DNS servers.
What to do now
0 of 8 done
Detection and monitoring
The sources do not report any attacks in the wild, but a public exploit generally lowers the effort needed to try this against exposed devices. As a precaution, look through any logs you can access for requests to /cgi-bin/wapi.cgi from addresses you do not recognize. Also watch for unexpected reboots, new or changed port forwarding entries, and outbound connections from the router that you cannot explain.
If the router fronts a website, keep general monitoring in place for the site itself, such as uptime, certificate and DNS changes. Webforta Monitor offers this kind of monitoring. It is not specific to this flaw, but unexpected changes there can prompt you to inspect your gateway.
If you suspect a device was compromised, factory reset it, reflash vendor firmware, set new credentials, and follow the steps in Website hacked: what to do.
Timeline
| Date | Event |
|---|---|
| Before Nov 1, 2026 | Vendor contacted early about the disclosure, per the advisory (exact date not given) |
| Nov 1, 2026 | CVE published by NVD and added to the GitHub Advisory Database |
| Nov 1, 2026 | Advisory last updated; no patched versions listed |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.