Description
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Published: 2026-10-15
Score: 10 Critical
EPSS: 3.1% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in sub_12580 of the api.cgi file causes the REMOTE_ADDR argument to be processed without proper validation, allowing an attacker to inject operating system commands. The injection can be invoked remotely, giving the attacker the ability to execute arbitrary commands on the device, thereby compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects Wavlink WL‑WN530BE2‑A routers running firmware versions up to M30BE2_V250604. Firmware 2026‑09‑24‑841a51c6d5_tclinux.bin includes the fix and removes the unsafe system() usage, replacing it with execvp and input validation.

Risk and Exploitability

With a CVSS score of 10 the flaw is rated critical, and an EPSS score of 3% indicates a moderate probability that exploitation occurs. The attack is launched remotely through the vulnerable API, and once leveraged it can grant full system compromise, enabling the attacker to pivot to other assets on the network.

Generated by OpenCVE AI on October 16, 2026 at 20:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply firmware update 2026‑09‑24‑841a51c6d5_tclinux.bin to the device
  • Configure firewall or ACLs to restrict access to the admin API endpoint to trusted IPs only
  • If patching cannot occur immediately, block or disable remote access to the affected API and consider disabling remote management features to prevent exploitation

Generated by OpenCVE AI on October 16, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Title Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
First Time appeared Wavlink
Wavlink wl-wn530be2-a
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wl-wn530be2-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn530be2-a
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wl-wn530be2-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T02:40:46.273Z

Reserved: 2026-10-15T09:30:55.331Z

Link: CVE-2026-110957

cve-icon Vulnrichment

Updated: 2026-10-20T02:40:41.743Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T15:17:30.640

Modified: 2026-10-20T03:17:14.930

Link: CVE-2026-110957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T02:15:17Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')