WAVLINK WN579X3-D: OS command injection in port_forward function
Summary
A command injection flaw in the port_forward function of /cgi-bin/wapi.cgi on the WAVLINK WN579X3-D router (firmware V250402) allows an attacker to inject operating system commands through the name parameter. The CVSS vector assumes an attacker with low-privilege access, but the login requirement is not fully confirmed, and sources disagree on it. A public proof of concept exists and no vendor fix has been found, so the device should be treated as unpatched. Successful exploitation can lead to full compromise of the device.
Affected
- WAVLINK WN579X3-D, firmware M79X3D.V250402 (M_V250402)
Fixed in
Unknown. No vendor advisory or fixed firmware found.
Workaround
- Disable remote (WAN) administration and do not expose the web interface to the internet.
- Restrict access to the admin interface to a management VLAN or trusted IP addresses.
- Change the admin credentials.
- Ask WAVLINK whether a fixed firmware exists.
Exploitation
- Public proof of concept: yes (VulDB status Proof-of-Concept).
- Exploited in the wild: unknown.
- Not listed in CISA KEV according to Strix.
Our recommendation
- Check whether any WN579X3-D devices are in use and whether their web interface is reachable from the internet.
- Restrict or disable remote access now and limit access to trusted networks.
- Ask WAVLINK for a fixed firmware version and apply it as soon as one is available.
- If no fix is published, plan the replacement of the device.
- Monitor the device for unexpected configuration changes or outbound connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry vuldb.com
- VulDB submission vuldb.com
- Proof of concept reference github.com
- Strix CVE page www.strix.ai
- OffSeq radar entry radar.offseq.com
- Threatint CVE page cve.threatint.com
- Vulners product listing vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:40.
Original description (NVD)
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.