CVE-2020-12124: WAVLINK WN530H4 live_api.cgi unauthenticated root command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution as root with a CVSS score of 9.8 and very high EPSS probability makes this an urgent exposure for any internet-reachable WN530H4.

What it is

The /cgi-bin/live_api.cgi endpoint on the WAVLINK WN530H4 (firmware M30H4.V5030.190403) passes input to a shell without sanitisation, allowing OS command injection. Because the endpoint is reachable without authentication and commands run as root, any network-reachable device is at risk of full compromise.

Impact

An attacker gains arbitrary command execution as root on the router, enabling full control of the device, interception or redirection of traffic, and use of the device as a foothold into the internal network.

Attack surface

Reachable over the network via HTTP requests to /cgi-bin/live_api.cgi; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.7465, ~99.5th percentile), indicating substantial predicted exploitation activity; references are only third-party and vendor advisories, with no public exploit tag.

What to do

• Apply the latest WAVLINK firmware for the WN530H4 if the vendor has released a fix; if no patch exists, treat the device as end-of-life and replace it.
• Block external and untrusted access to the router's web management interface, including /cgi-bin/live_api.cgi, at the firewall or by disabling remote administration.
• Place the device on an isolated network segment or VLAN so a compromise cannot reach other internal hosts.
• If the device must remain in use, restrict management access to a trusted administrative network only and monitor it closely.

Detection

• Inspect HTTP request logs or packet captures for requests to /cgi-bin/live_api.cgi containing shell metacharacters (;, |, $(), backticks) or unexpected command strings.
• Monitor router and upstream logs for outbound connections or processes spawned by the web server that are inconsistent with normal device behaviour.
• Alert on repeated or anomalous requests to /cgi-bin/live_api.cgi from external or non-administrative source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.