Wavlink Router Firmware Contains Critical Remote Command Injection Flaw
Unauthenticated attackers can execute root commands on Wavlink WL-WN530BE1-A devices by exploiting a critical OS command injection vulnerability in the firmware.
Key points
- CVE-2026-113802 is rated 9.3 Critical by the National Vulnerability Database.
- The flaw allows remote, unauthenticated code execution as the root user.
- Attackers bypass authentication by forging an IP-FROM header to 127.0.0.1.
Wavlink WL-WN530BE1-A router firmware contains a critical remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands with root privileges. The National Vulnerability Database has assigned CVE-2026-113802 to this flaw, rating it 9.3 on the CVSS scale, which indicates a severe risk to network security and device integrity.
At a glance
- CVE
- CVE-2026-113802
- Product
- Wavlink WL-WN530BE1-A
- CVSS
- 9.3 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The vulnerability exists within the ioos binary, specifically in the sub_23B54 function, which processes requests to the /protocol.csp endpoint. When handling delete operations for OpenVPN files, the function passes an unsanitized file_id parameter directly to the popen() system call. This lack of input validation enables OS command injection, a weakness categorized under CWE-78, allowing attackers to inject and execute malicious operating system commands on the device.
Authentication Bypass Mechanism
A remote attacker can exploit this vulnerability without valid login credentials by manipulating HTTP request headers. By sending a forged IP-FROM header with the value 127.0.0.1, the attacker tricks the router into believing the request originates from localhost. This bypasses the authentication check, granting the attacker access to the vulnerable endpoint and enabling full control over the device as the root user.
Affected Firmware Versions
The National Vulnerability Database identifies Wavlink WL-WN530BE1-A firmware versions through M30BE1_V251117 as affected by CVE-2026-113802. Devices running these specific firmware builds are susceptible to remote exploitation if exposed to the internet or accessible to untrusted networks. No newer firmware version has been confirmed in the source material to address this specific critical vulnerability at this time.
What should you do?
Security professionals should immediately verify if any Wavlink WL-WN530BE1-A routers are present in their network environments. Administrators should check the current firmware version against the affected list provided in the NVD record. Since no patch is confirmed, isolating affected devices from untrusted networks is the primary mitigation strategy until a vendor update becomes available.
Background: Router firmware vulnerabilities
Small businesses face exposure because default router firmware rarely updates automatically. Protect your network by isolating devices, enforcing strict access controls, and verifying that your IT provider manages firmware lifecycle rather than just initial configuration.
Read the full guide: Router Firmware Vulnerabilities: Risks and Protection for Small Businesses
What to do and how to stay safe: Wavlink
- Audit network inventory to identify any Wavlink WL-WN530BE1-A routers currently in use.
- Check the firmware version of identified devices to see if it matches M30BE1_V251117 or earlier.
- Isolate affected routers from the internet or place them behind strict firewall rules blocking external access.
- Monitor network traffic for unusual requests to the /protocol.csp endpoint or forged IP-FROM headers.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-113802?
The National Vulnerability Database rates CVE-2026-113802 as 9.3, which is classified as Critical.
How can an attacker bypass authentication on this device?
An attacker can bypass login by sending a forged IP-FROM header with the value 127.0.0.1 to the router.
Which Wavlink router model is affected by this vulnerability?
The Wavlink WL-WN530BE1-A router is affected, specifically firmware versions through M30BE1_V251117.
