9.8
CriticalCVSS 3.1 · from VulnCheck
CVE-2026-113802
Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
WL-WN530BE1-A · OS command injection · CWE-78AffectedWL-WN530BE1-A
FixNo fix listed yet.
PublishedOct 20, 17:59 · VulnCheck
ScoredOct 20 · 9.8 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inWL-WN530BE1-AM30BE1_V251117–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known