CVE-2026-109108
CriticalCVSS 9.9Summary
The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.
Risk Assessment
Remote execution of arbitrary system commands on the device is possible, potentially leading to full router compromise. The exploit has been publicly disclosed and may be used.
Recommendation
Apply the vendor patch when available, and until then restrict access to the router's CGI interface from untrusted networks.
Other vulnerabilities in Wavlink WL-WN530BE1-A
Original NVD description (English source)
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS