Wavlink WL-WN530BE1-A Firmware Has Critical Remote Code Execution Flaw
Unauthenticated attackers can execute root commands on Wavlink WL-WN530BE1-A devices via command injection in firmware through version M30BE1_V251117.
Key points
- CVE-2026-113802 allows remote unauthenticated code execution as root.
- The flaw exists in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117.
- No vendor patch or mitigation guidance has been confirmed yet.
Wavlink WL-WN530BE1-A devices contain a critical remote command injection vulnerability that allows attackers to execute arbitrary commands as root. The flaw affects firmware versions through M30BE1_V251117 and carries a CVSS score of 9.3.
What happened
Security researchers identified an OS command injection flaw in the ioos binary of the affected Wavlink WL-WN530BE1-A firmware. The vulnerability resides in the sub_23B54 function, which processes requests to /protocol.csp?opt=ovpn_file with type=del. According to the National Vulnerability Database record for CVE-2026-113802, the system passes an unsanitized file_id parameter directly to the popen() function. This weakness is classified under CWE-78, which covers improper neutralization of special elements used in an OS command.
An attacker can exploit this flaw without authentication by sending a forged IP-FROM: 127.0.0.1 header. This header manipulation bypasses the device's login controls, allowing the malicious payload to execute with root privileges. The issue affects Wavlink WL-WN530BE1-A devices running firmware version M30BE1_V251117 or earlier. As Patch Gazette reported on 2026-10-19, EG Secure Solutions patched a similar command injection flaw in SiteGuard that allowed root access.
Why it matters
This vulnerability enables complete remote takeover of the affected device without requiring valid credentials. Attackers can execute any command as the root user, potentially installing malware, stealing data, or pivoting to other systems on the network. The ease of exploitation, combined with the critical severity rating, makes this a high-priority risk for any environment using these devices.
The ability to bypass authentication via header forgery removes a primary security control. This mirrors the severity seen in other recent device flaws, such as the AllData JDBC injection reported by Patch Gazette on 2026-10-16. Organizations must treat this as an urgent risk because the attack surface is exposed to the internet if the device is accessible externally.
What to watch
- Monitor vendor channels for official firmware updates addressing CVE-2026-113802.
- Check network logs for unexpected outbound connections or unusual process executions.
- Look for signs of unauthorized configuration changes on affected devices.
- Watch for security advisories related to similar command injection flaws in networking gear.
Who needs to act first
Teams should prioritize isolating exposed Wavlink WL-WN530BE1-A devices from untrusted networks immediately. Since no patch exists, administrators must restrict access to the device management interface using strict firewall rules. Check whether the devices are accessible from the internet and block external traffic to the device ports. Test connectivity from internal segments to ensure business operations continue while reducing exposure. Back up current configurations before making any network changes to facilitate recovery.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe
- Block external access to the device's management interface using firewall rules.
- Monitor system logs for signs of unauthorized command execution or login bypass attempts.
- Verify that no other devices on the network have been compromised by lateral movement.
- Once the vendor provides an update, test the firmware upgrade in a controlled environment before deployment.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wavlink products are affected by CVE-2026-113802?
The Wavlink WL-WN530BE1-A is affected, specifically firmware versions through M30BE1_V
