# CVE-2026-120196: WAVLINK WN579X3-D OS command injection in port forwarding

Source: https://junglewise.ai/threats/cve-2026-120196-a-vulnerability-was-detected-in-wavlink-wn579x3-d-v250402-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120196 · Severity: critical · CVSS 9.9 · Published 2026-11-01

The WAVLINK WN579X3-D router contains an OS command injection vulnerability in its web management interface that allows authenticated attackers to execute arbitrary commands with root privileges. An attacker with valid login credentials can manipulate the port forwarding function to inject shell commands, potentially gaining complete control of the device and the networks it protects.

Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120196 being exploited in the wild.

**How severe is CVE-2026-120196?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Wavlink WN579X3-D M79X3D.V250402.

**Is there a fix for CVE-2026-120196?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120196 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120196?** Check whether you run Wavlink WN579X3-D at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated OS command injection exists in the port_forward function of /cgi-bin/wapi.cgi due to weak input validation that only blacklists backticks and semicolons. Attackers can bypass this filter using characters like pipes and redirects in the name parameter, which is then passed unsanitized to popen() for command execution. The attack requires valid authentication and a minimally-bypassed Referer header check.

## Affected products

- WAVLINK WN579X3-D M79X3D.V250402

## Timeline

- 2026-11-01: disclosed
- 2026-11-01: exploited: exploit is now public

## References

- [https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md](https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md)
- [https://vuldb.com/cve/CVE-2026-120196](https://vuldb.com/cve/CVE-2026-120196)