A stack‑based buffer overflow occurs in the CGI through the strcpy function when an attacker manipulates the HTTP_COOKIE or X‑Cmd parameters in ExportAllSettings.cgi. This flaw can be triggered remotely via normal HTTP requests, enabling the attacker to execute arbitrary code or crash the device. The vulnerability is classified as CWE‑119 and CWE‑121, and its impact is the ability to compromise confidentiality, integrity, and availability of the router.

The affected device is the Wavlink WL‑WN530BE1‑A, firmware version 251117.

The CVSS score of 10 signals a critical vulnerability. Although the EPSS score is not available, the exploit is publicly available and could be used by any remote host that can reach the router’s web interface. KEV has not listed it yet, but the public nature of the exploit and the absence of authentication barriers make it a high‑risk attack vector. An attacker could trigger the overflow simply by crafting an HTTP request containing malicious cookie or X‑Cmd values, and the router would execute the payload with system privileges.