Vulnerability record/PUBLISHED/Published Nov 1, 2026 03:45:22 UTC

CVE-2026-120197

A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Base score9.4/ 10

SeverityCriticalCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityHighSC

Subsequent system integrityHighSI

Subsequent system availabilityHighSA

Exploit maturityProof of conceptE

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulDB

Last updatedNov 1, 2026 03:45:22 UTC

PublishedNov 1, 2026 03:45:22 UTC

ReservedOct 31, 2026 11:43:47 UTC

Credits

hackerpipi (VulDB User)
VulDB CNA Team