WAVLINK WL-WN579A3-A: OS command injection in Initial Setup Wizard
Summary
WAVLINK WL-WN579A3-A routers with firmware build 2026-03-10 (94f93d4) contain an OS command injection flaw in the Initial Setup Wizard (/cgi-bin/adm.cgi, function set_wzdgwMesh, parameter wlan_ssid). A remote attacker can send a crafted request to execute arbitrary commands as root on the device. No login or user interaction is required, but the flaw only applies while the device is still in its initial setup state, for example out of the box or after a factory reset. A public proof-of-concept exists.
Affected
- WAVLINK WL-WN579A3-A, firmware 2026-03-10-94f93d4 (WINSTAR_WN579A3-A-2026-03-10-94f93d4)
- Other firmware builds: Unknown.
Fixed in
Unknown. No vendor-confirmed fixed firmware was found at the time of research. Ask WAVLINK support for the current firmware.
Workaround
- No vendor workaround confirmed.
- Keep the web interface off untrusted networks and limit admin access to a management VLAN.
- Make sure the setup wizard is not reachable from WAN or guest networks.
- Check whether the setting UserInit is still 0 and complete the initial setup if needed.
Exploitation
- A public proof-of-concept exists (GitHub write-up referenced in the CVE record). VulDB rates the exploit maturity as proof-of-concept.
- No evidence of exploitation in the wild in the reviewed sources. CISA KEV was not checked.
- Related command-injection CVEs exist for the same model family.
Our recommendation
- Identify WL-WN579A3-A devices in your network and record their firmware build.
- Make sure the setup wizard is completed and not reachable from untrusted networks.
- Replace the device or isolate it from sensitive systems if no fixed firmware is available.
- Check NVD for the official CVSS score, as the 9.3 value differs from the 10.0 reported by VulDB.
- Monitor the router for unexpected configuration changes or unusual outbound connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry CVE-2026-120195 vuldb.com
- VulDB vulnerability 429558 vuldb.com
- Public write-up (pipiyyb/cve on GitHub) github.com
- OffSeq Radar threat record CVE-2026-120195 radar.offseq.com
- WAVLINK WL-WN579A3 product page www.wavlink.com
- WAVLINK firmware details wify.wavlink.com
- CVE mirror threatint CVE-2026-120195 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:20.
Original description (NVD)
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.