Wavlink WL-WN530BE2-A Router Patched for Critical Remote Command Injection Flaw

Wavlink has addressed a critical security vulnerability in its WL-WN530BE2-A wireless router model that allowed remote attackers to execute arbitrary operating system commands. The flaw, identified as CVE-2026-110957, was found in versions of the firmware up to M30BE2_V250604 and is rated with a CVSS score of 10, indicating critical severity.

The vulnerability resides in the Login Processing component, specifically within the api.cgi file. According to the National Vulnerability Database record, the weakness stems from improper handling of the REMOTE_ADDR argument in the sub_12580 function. This misconfiguration leads to OS command injection, a severe flaw that permits an attacker to run shell commands on the device from a remote location.

Technical Details and Vendor Response

The exploit has been disclosed to the public, and the method for abuse is known. The National Vulnerability Database lists the associated weaknesses as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Improper Neutralization of Special Elements used in a Command). These categories highlight the failure to properly sanitize user-supplied input before passing it to system-level functions.

Wavlink has confirmed the finding and stated that the issue has been resolved in their current firmware. The vendor explained that the specific handler for api=info&client=app no longer constructs shell commands. Instead, the login script is now invoked through an argument vector using execvp, rather than the system() call. This change eliminates the injection vector by treating input as data rather than executable code.

Additionally, the vendor noted that the client address input is now subject to length limits and null-checks. These extra validation steps further reduce the risk of buffer overflows or other input-based attacks. The fix is available in the firmware version 2026-09-24-841a51c6d5_tclinux.bin, which users are advised to install immediately to mitigate the risk.

Affected Devices and Scope

The vulnerability affects Wavlink WL-WN530BE2-A routers running firmware versions up to M30BE2_V250604. Any device operating on these older builds is potentially exposed to remote exploitation. Because the attack can be initiated remotely, attackers do not need physical access to the device or prior authentication to exploit the flaw.

The public disclosure of the exploit means that threat actors may actively scan for vulnerable instances of this router model. Since the vulnerability is in the login processing component, it may be triggered during normal network interactions or targeted attacks aimed at gaining initial access to the device.

What should you do?

Administritors and users of Wavlink WL-WN530BE2-A routers should verify their current firmware version immediately. If the device is running version M30BE2_V250604 or earlier, it is recommended to upgrade to version 2026-09-24-841a51c6d5_tclinux.bin. This update contains the necessary patches to resolve the command injection vulnerability.