Description
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Published: 2026-10-13
Score: 9.4 Critical
EPSS: 1.7% Low
KEV: No
Impact: Remote command execution via OS command injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection flaw in the popen function of the uploadVpn.cgi script on the Wavlink WL-WN530BE1-A router, allowing attackers to inject arbitrary shell commands by manipulating the Type argument. Exploiting this flaw can give an attacker full control over the device’s operating system, leading to unauthorized changes, data exfiltration, or service disruption. The flaw does not require authentication; the description confirms that attackers can trigger it remotely.

Affected Systems

The affected product is the Wavlink WL-WN530BE1-A router running firmware version 251117. No other firmware revisions are cited as vulnerable in the current CVE data.

Risk and Exploitability

The CVSS score of 9.4 denotes critical severity, and the EPSS score of 2% indicates a low to moderate probability of exploitation. The vulnerability is publicly disclosed, with a working exploit available, but it is not listed in CISA’s KEV catalog. The attack vector is remote, via an HTTP request to /cgi-bin/uploadVpn.cgi containing a malicious Type value, which will be executed by the underlying operating system shell.

Generated by OpenCVE AI on October 17, 2026 at 07:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor’s website for any firmware updates or patches that address the OS command injection issue.
  • If a patch is not available, block or remove remote access to the /cgi-bin/uploadVpn.cgi endpoint, or disable the VPN upload feature entirely.
  • Restrict outbound network connections from the device and isolate it from critical infrastructure while monitoring device logs for anomalous command execution patterns.

Generated by OpenCVE AI on October 17, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Title Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
First Time appeared Wavlink
Wavlink wl-wn530be1-a
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wl-wn530be1-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn530be1-a
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wl-wn530be1-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T21:38:50.808Z

Reserved: 2026-10-12T08:32:54.413Z

Link: CVE-2026-109108

cve-icon Vulnrichment

Updated: 2026-10-16T21:38:44.092Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T08:16:59.917

Modified: 2026-10-16T22:17:18.117

Link: CVE-2026-109108

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T20:15:09Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')