CVE-2026-120195 in WL-WN579A3-A
Summary
by MITRE • 11/01/2026
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in the WAVLINK WL-WN579A3-A router firmware, specifically within the Initial Setup Wizard component, represents a critical remote code execution risk stemming from improper input validation in the web management interface. The flaw resides in the set_wzdgwMesh function located within the /cgi-bin/adm.cgi script, which is responsible for handling configuration parameters during the device setup process. This particular area of firmware often handles sensitive network configurations and user credentials, making it a high-value target for attackers seeking to gain persistent access or disrupt network operations. The presence of this vulnerability indicates a fundamental failure in implementing secure coding practices within the embedded web server environment that powers the router's administrative interface.
At the technical core, the issue is classified as an OS command injection flaw triggered by the manipulation of the wlan_ssid argument. When the application processes user-supplied input for the wireless network name without adequate sanitization or escaping, it allows malicious actors to inject arbitrary operating system commands into the underlying shell execution context. This typically occurs when developer code concatenates unsanitized variables directly into a command string that is then passed to functions like system() or exec(). By crafting a specially formatted SSID containing shell metacharacters such as semicolons, pipes, or backticks, an attacker can break out of the intended parameter context and execute commands with the privileges of the web server process. This bypasses any application-level logic designed to restrict user actions to legitimate configuration changes only.
The operational impact of this vulnerability is severe due to its remote exploitability without authentication requirements in many initial setup scenarios or if default credentials are still active. An attacker located anywhere on the internet can send a crafted HTTP request to the router's CGI endpoint, resulting in arbitrary command execution on the device. This capability allows for complete compromise of the affected hardware, enabling the installation of malware such as botnet clients, crypto-miners, or backdoors that provide persistent access even after reboots. Furthermore, it facilitates lateral movement within a local network by allowing the attacker to scan internal subnets, intercept unencrypted traffic, or pivot into more critical systems connected to the same router. The public disclosure and availability of exploit code significantly lower the barrier for entry, increasing the likelihood of automated attacks targeting vulnerable devices at scale across global networks.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK techniques related to Remote Services and Execution via Web Applications, specifically highlighting the abuse of administrative interfaces for initial access. The lack of input validation on a network-facing service is a classic example of how embedded devices often prioritize functionality over security during development cycles. To mitigate this risk, users should immediately update their router firmware if a patched version has been released by WAVLINK or the relevant distributor. If no patch exists, temporary mitigations include disabling remote management features entirely and ensuring that only trusted local networks can access the administrative interface. Additionally, implementing network segmentation to isolate IoT devices from critical workstations and servers limits the potential blast radius of such compromises until a permanent software fix is deployed by the vendor.