CVE-2026-120195
Critical · 10.0CVSS
10.0
EPSS
2.1%
Published
Nov 1, 2026
CISA due date
—
The record
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-95727 A command injection vulnerability exists in HPE Networking VIA. CWE-77
- CVE-2026-105982 Improper input validation in the IPsec VPN function may allow a remote attacker with high… CWE-77
- CVE-2026-105980 Improper input validation in the WireGuard VPN function may allow a remote attacker with… CWE-77
- CVE-2026-105979 Improper input validation in the ZeroTier VPN function may allow a remote attacker with… CWE-77
- CVE-2026-120345 A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120344 A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120282 A vulnerability was determined in WAVLINK WN536AX6-A V260507. CWE-77
- CVE-2026-120279 A flaw has been found in WAVLINK WN536AX6-A V260507. CWE-77