CVE-2026-120198
CriticalCVSS 10.0Summary
A vulnerability was found in WAVLINK WL-WN530BE1-A V251117 in the con_check_read_finish function of /protocol.csp. Manipulation of the group_name/IP-FROM argument leads to command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could execute arbitrary commands on the device, potentially leading to full compromise of the router or access point. The publicly available exploit increases the likelihood of abuse.
Recommendation
Update the device firmware to the vendor-fixed version or restrict access to the management interface from untrusted networks. Until a patch is available, consider isolating the device on the network.
Other vulnerabilities in WAVLINK WL-WN530BE1-A
See all- CVE-2026-113802Critical
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
- CVE-2026-109109Critical
The Wavlink WL-WN530BE1-A router version 251117 contains a stack-based buffer overflow in the strcpy function of /cgi-bin/ExportAllSettings.cgi in the Settings Export CGI component. Manipulating the HTTP_COOKIE/X-Cmd argument allows remote attack.
- CVE-2026-109108Critical
The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.
Original NVD description (English source)
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS