External risk intelligence

WAVLINK WL-WN579A3 Initial Setup Wizard OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120195

The vulnerability affects a WAVLINK wireless router component, specifically an administrative CGI script used for initial setup. Such router management interfaces and setup wizards are commonly exposed over the network, and in many consumer deployments, these interfaces are reachable from the network edge, making them a common target for remote access via the web.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a WAVLINK wireless router product that could allow an attacker to execute arbitrary commands remotely. This issue stems from how the device handles an input related to its wireless network name during the initial setup process. The potential for remote command execution raises concerns about the integrity and control of affected devices.

A router setup flaw enables remote command execution.
This could impact device control and network security.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could remotely target the WAVLINK WL-WN579A3-A by sending specially crafted input to the Initial Setup Wizard's web interface. This interface is exposed over the network, and the attacker can manipulate the `wlan_ssid` argument within the `set_wzdgwMesh` function of the `/cgi-bin/adm.cgi` file. Successful manipulation allows the attacker to inject operating system commands, potentially leading to a complete compromise of the device.

No authentication or special access required.
Manipulate `wlan_ssid` argument in CGI script.
Execute arbitrary OS commands remotely.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the affected device when it is reachable over the network. This could impact the device's configuration and potentially its network services.

Device configuration and network services.
Remotely via manipulation of setup arguments.
Compromise of device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a critical OS command injection vulnerability in the WAVLINK WL-WN579A3's Initial Setup Wizard suggests that infrastructure or platform teams managing network devices are likely responsible. The immediate priority is to locate all instances of this device, determine their exposure (internal vs. external), and assess their business criticality. Once accountable owners are identified, remediation efforts can be planned and prioritized.

Identify affected devices and ownership.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WL-WN579A3-A device?

The WAVLINK WL-WN579A3-A is a wireless networking device, such as a router or range extender, designed to manage local connectivity. It includes an Initial Setup Wizard, which is a web-based utility that helps users configure settings like wireless network names (SSIDs) during first-time installation.

How does CVE-2026-120195 function as a vulnerability?

This vulnerability is an OS command injection flaw, categorized under CWE-77 and CWE-78. It occurs when the device's administrative software fails to safely sanitize user input. By sending malicious data through the wlan_ssid argument in a specific setup function, an attacker can trick the system into running unauthorized operating system commands.

Do I need to be authenticated to trigger this flaw?

No. The vulnerability exists within a component that processes input without requiring a login or administrative session. Simply interacting with the vulnerable CGI script over the network allows the command injection to proceed. Normal, legitimate network usage that does not involve submitting specially crafted SSID parameters will not trigger this issue.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that because this vulnerability involves an administrative setup interface often reachable over the network, it is classified as external. Devices with management interfaces accessible from the internet face a higher risk, as they are reachable by remote actors rather than only those on your local private network.

What should I do if I manage this router?

The first step is to identify all deployed instances of the affected WAVLINK hardware within your environment. Once identified, verify whether their management interfaces are accessible from the internet or restricted to internal networks. Document ownership for these devices to prepare for applying official vendor security updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.