The vulnerability is an OS command injection in the ioos sub_23B54 function of the /protocol.csp?opt=ovpn_file endpoint. The unsanitized file_id parameter is passed directly to popen(), allowing an attacker to inject arbitrary shell commands. An unauthenticated attacker can forge an IP-FROM header of 127.0.0.1 to bypass authentication and obtain root privileges. This flaw matches CWE-78 and enables complete compromise of the affected device.

Wavlink WL-WN530BE1-A devices running firmware through M30BE1_V251117 are affected. No other vendors or product versions are listed as impacted.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, but the high CVSS and lack of protections suggest a significant exploit probability. The vulnerability is not listed in CISA KEV, yet the attack vector—remote unauthenticated access via HTTP with a forged IP-FROM header—is straightforward to carry out on exposed interfaces. An attacker only needs network connectivity to the device's administration interface to exploit this flaw.