9.9
CriticalCVSS 3.1 · from VulDB
CVE-2026-109108
Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
WL-WN530BE1-A · OS command injection · CWE-78AffectedWL-WN530BE1-A
FixNo fix listed yet.
PublishedOct 13, 07:30 · VulDB
ScoredOct 13 · 9.9 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
From VulDB
Affected and fixed versions
ProductAffectedFixed inWL-WN530BE1-A251117–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known