Skip to content
Critical OS Command Injection Vulnerability in Wavlink Firmware

Critical OS Command Injection Vulnerability in Wavlink Firmware

First seen 21 Oct 2026, 02:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 04:20 UTC
  • •CVE-2026-113802 affects Wavlink WL-WN530BE1-A firmware version M30BE1_V251117.
  • •The vulnerability allows unauthenticated remote command execution as root.
  • •No public proof-of-concept code has been confirmed at this time.

CVE-2026-113802 has been identified in the Wavlink WL-WN530BE1-A firmware version M30BE1_V251117, which contains an OS command injection vulnerability in the ioos binary's sub_23B54 function. This flaw arises from the unsanitized handling of the file_id parameter in requests made to /protocol.csp?opt=ovpn_file with type set to 'del'. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request with a forged IP-FROM header set to 127.0.0.1, allowing for arbitrary command execution with root privileges. As of now, no public proof-of-concept (PoC) code has been confirmed, but the vulnerability has a CVSS score of 9.8, indicating a critical severity. Users are advised to update their firmware to a version beyond M30BE1_V251117 and restrict access to the device's management interface. Monitoring for suspicious requests to /protocol.csp endpoints is also recommended.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
CVE-2026-113802 published
Wavlink disclosed an OS command injection vulnerability in their firmware, assigning it a CVSS score of 9.8.
Feedly
2026-10-21
Vulnerability details confirmed
Multiple sources confirmed the OS command injection vulnerability and its impact on Wavlink devices.
vulnerability.circl.lu
2026-10-21
Exploit known to exist
Reports indicate that exploitation of the vulnerability is known to exist, raising concerns about potential attacks.
securityvulnerability.io

More articles in this cluster (5)

Following this threat?

Track CVE-2026-113802 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

Which firmware versions are affected?
Wavlink WL-WN530BE1-A firmware version M30BE1_V251117 is affected.
Is there a proof of concept available?
No public proof of concept has been confirmed as of now.
What immediate actions should be taken?
Update the firmware to a version beyond M30BE1_V251117 and restrict access to the management interface.