Wavlink WL-WN530BE1-A: OS command injection in uploadVpn.cgi
Summary
The web interface of the Wavlink WL-WN530BE1-A Wi-Fi 7 router, firmware 251117, fails to neutralise the Type argument of the uploadVpn.cgi handler before passing it to popen. A remote attacker with low privileges can inject operating system commands and, according to the CVSS vector, fully compromise confidentiality, integrity and availability of the device. The exploit is publicly claimed, but this could not be verified, and no vendor fix has been found.
Affected
- Wavlink WL-WN530BE1-A, firmware 251117 (build M30BE1_V251117)
- Affected function: popen in /cgi-bin/uploadVpn.cgi, parameter Type
Fixed in
Unknown. No vendor advisory or fixed firmware has been found.
Workaround
- No vendor workaround published.
- Disable remote (WAN) access to the web management interface and VPN features.
- Restrict admin access to a trusted LAN segment or trusted IP addresses.
- Change the admin password and remove port forwards to the router web UI.
Exploitation
- A public exploit is claimed in the CVE description; not verified.
- No known exploitation in the wild and no CISA KEV listing at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether the device is in use and whether its web interface or VPN features are reachable from the internet.
- Apply the isolation and restriction measures listed above now.
- Replace or isolate the device if no vendor firmware is released.
- Monitor the Wavlink support channel and the NVD record for updates.
- Review related CVE-2026-113802 and CVE-2026-120198 on the same model.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-109108 vuldb.com
- VulDB advisory 416859 vuldb.com
- Public exploit claim (Gist) gist.github.com
- Strix CVE-2026-109108 www.strix.ai
- HOL Guard CVE-2026-109108 hol.org
- Wavlink WL-WN530BE1 product page www.wavlink.com
- Wavlink firmware guidance docs.wavlink.xyz
- Strix CVE-2026-113802 (related) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:36.
Original description (NVD)
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.