---
id: CVE-2026-120197
title: WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
summary: >-
  A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the
  function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the
  argument Name causes os command injection. It is possible to initiate the
  attack remo…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
vendor: WAVLINK
product: WL-WN530HG4B
affected:
  - WL-WN530HG4B M_V260724
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T17:15:51.145328Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:43:36.802Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120197'
references:
  - url: 'https://vuldb.com/vuln/429560'
    label: >-
      VDB-429560 | WAVLINK WL-WN530HG4B wapi.cgi port_forward os command
      injection
  - url: 'https://vuldb.com/vuln/429560/cti'
    label: 'VDB-429560 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120197'
    label: CVE-2026-120197 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/917074'
    label: 'Submit #917074 | WAVLINK WL-WN530HG4B M_V260724 CWE-78'
  - url: 'https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md'
tags:
  - cve.org
  - exploit-available
epss: 0.01687
epssPercentile: 0.77096
ingestedAt: '2026-11-05T19:30:42.744Z'
---

## Overview

A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

## Affected

- `WL-WN530HG4B M_V260724`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.