The vulnerability is an OS command injection in the ioos sub_23B54 function of the /protocol.csp?opt=ovpn_file endpoint. The unsanitized file_id parameter is passed directly to popen(), allowing an attacker to inject arbitrary shell commands. An unauthenticated attacker can forge an IP-FROM header of 127.0.0.1 to bypass authentication and obtain root privileges. This flaw matches CWE-78 and enables complete compromise of the affected device.

Wavlink WL-WN530BE1-A devices running firmware through M30BE1_V251117 are affected. No other vendors or product versions are listed as impacted.

The CVSS score of 9.3 indicates critical severity. The EPSS score is 3%, reflecting a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV, yet the attack vector—remote unauthenticated access via HTTP with a forged IP‑FROM header—is straightforward to carry out on exposed interfaces. An attacker only needs network connectivity to the device's administration interface to exploit this flaw.