CVE-2026-109109

CriticalCVSS 10.0

Published: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Summary

The Wavlink WL-WN530BE1-A router version 251117 contains a stack-based buffer overflow in the strcpy function of /cgi-bin/ExportAllSettings.cgi in the Settings Export CGI component. Manipulating the HTTP_COOKIE/X-Cmd argument allows remote attack.

Risk Assessment

Remote code execution or device crash is possible. The exploit is publicly available and may be used by attackers.

Recommendation

Apply the vendor patch when available, and until then restrict access to the router's CGI interface from untrusted networks.

Other vulnerabilities in Wavlink WL-WN530BE1-A

CVE-2026-109108Critical
The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.

Original NVD description (English source)

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS