WAVLINK WL-WN579A3-A: Remote OS command injection (CVE-2026-120195)
A remote OS command injection vulnerability exists in the Initial Setup Wizard of WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4.
CVE search metadata
CVE search record: CVE-2026-120195. Severity: critical. CVSS: 10.0. KEV: no. Product: WL-WN579A3-A (2026-03-10-94f93d4). Brief: WAVLINK WL-WN579A3-A: Remote OS command injection (CVE-2026-120195). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wavlink-rce/
Triage facts
Revision 1- Applicability
- WL-WN579A3-A (2026-03-10-94f93d4)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 1, 04:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security vulnerability has been detected in WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4. The vulnerability is located in the set_wzdgwMesh function within /cgi-bin/adm.cgi of the Initial Setup Wizard. Manipulation of the wlan_ssid argument leads to OS command injection. This vulnerability can be exploited remotely. Public disclosure of the exploit has occurred. The vendor was contacted early regarding this disclosure.
Severity
CVSS v3.1 Base Score: 10.0