10.0
CriticalCVSS 3.1 · from VulDB
CVE-2026-109109
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
WL-WN530BE1-A · Stack buffer overflow · CWE-121AffectedWL-WN530BE1-A
FixNo fix listed yet.
PublishedOct 13, 07:45 · VulDB
ScoredOct 13 · 10.0 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
From VulDB
Affected and fixed versions
ProductAffectedFixed inWL-WN530BE1-A251117–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known