Description
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in the con_check_read_finish function of /protocol.csp on WAVLINK WL-WN530BE1-A firmware V251117. By manipulating the group_name/IP-FROM argument the attacker can inject operating‑system commands. The injection capability allows the attacker to execute arbitrary commands on the router, compromising confidentiality, integrity and availability of the device and any connected network resources. This weakness maps to OS Command Injection and Improper Restriction of Operations within a Command.

Affected Systems

The vulnerability affects WAVLINK WL‑WN530BE1‑A routers. Any router with firmware V251117 or earlier is potentially exposed. The affected component is the web management interface served by /protocol.csp.

Risk and Exploitability

The CVSS score is 10, indicating critical risk. EPSS is not available, so current exploit probability cannot be quantified, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote over HTTP/HTTPS because the command injection originates from a web interface parameter. An attacker can reach the vulnerable endpoint from any external network, enabling a remote attacker to gain full control of the device.

Generated by OpenCVE AI on November 1, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the firmware update or patch released by WAVLINK that addresses the command injection in protocol.csp.
  • Limit the router’s management interface to the local network or a trusted IP range to reduce exposure.
  • If a patch is not yet available, block external HTTP/HTTPS access to the router’s web management interface or disable the /protocol.csp endpoint using firewall rules.
  • Continuously monitor device logs for abnormal command executions or repeated failed authentication attempts.

Generated by OpenCVE AI on November 1, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
First Time appeared Wavlink
Wavlink wl-wn530be1-a
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:wavlink:wl-wn530be1-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn530be1-a
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wl-wn530be1-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T04:15:16.456Z

Reserved: 2026-10-31T11:43:53.757Z

Link: CVE-2026-120198

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T05:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')