WAVLINK WL-WN530HG4B: OS command injection in wapi.cgi port_forward
Summary
The web CGI interface (wapi.cgi, port_forward function) of the WAVLINK WL-WN530HG4B router with firmware M_V260724 does not properly neutralize the name parameter before passing it to a shell command. An attacker who can reach the interface remotely and holds valid login or can bypass authentication may execute arbitrary operating system commands with the privileges of the web service, potentially fully compromising the device. A public proof of concept is available.
Affected
- WAVLINK WL-WN530HG4B, firmware M_V260724
Fixed in
- Unknown. No fixed version or vendor advisory has been published for this CVE.
Workaround
- Remove remote and WAN-side access to the web/CGI interface; keep management on the LAN only.
- Change default and shared admin credentials and review admin accounts.
- Block inbound traffic to the device with a firewall if remote access cannot be removed.
Exploitation
- Public proof of concept: yes (VulDB status: Proof-of-Concept).
- In the wild: not confirmed. Not listed on CISA KEV.
Our recommendation
- Identify all WL-WN530HG4B units and check the firmware version against M_V260724.
- Confirm that none of the devices are reachable from the internet.
- Ask WAVLINK in writing for a fixed firmware build and advisory.
- If no fix is confirmed, replace the device or isolate it behind a firewall.
- Monitor for unexpected outbound connections or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120197 vuldb.com
- VulDB entry 429560 vuldb.com
- Third-party write-up (GitHub pipiyyb/cve) github.com
- OffSeq Radar CVE-2026-120197 radar.offseq.com
- Strix CVE-2026-120197 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:38.
Original description (NVD)
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.