Wavlink WL-WN530BE1-A: Stack-based buffer overflow in Settings Export CGI
Summary
The Settings Export CGI (/cgi-bin/ExportAllSettings.cgi) of the Wavlink WL-WN530BE1-A Wi-Fi 7 router, firmware 251117, contains a stack-based buffer overflow caused by an unsafe strcpy call on the HTTP_COOKIE and X-Cmd arguments. A remote attacker can exploit it without credentials if the web interface is reachable, which may allow code execution or full control of the device. A public proof-of-concept exploit exists and the vendor has not published a fix.
Affected
- Wavlink WL-WN530BE1-A, firmware 251117 (also written M30BE1_V251117)
- Affected component: Settings Export CGI, /cgi-bin/ExportAllSettings.cgi
Fixed in
Unknown. No vendor fix or advisory has been found.
Workaround
- Disable remote/WAN management and do not forward admin ports to the device
- Restrict access to the web interface to trusted LAN hosts or a management VLAN
- Keep the device out of guest and IoT networks
Exploitation
- Public proof-of-concept exploit: reported (VulDB, exploit status Proof-of-Concept), not independently verified
- Known exploited in the wild: not reported
- Vendor response: none documented
- CISA SSVC: Automatable yes, Technical Impact total, Exploitation none
Our recommendation
- Inventory all Wavlink WL-WN530BE1-A devices and their firmware versions
- Verify that no device is reachable from the internet and remove WAN exposure and port forwards
- Plan replacement with a supported model if no vendor fix is published
- Monitor Wavlink's website and CVE feeds for firmware updates
- Also review the related issues CVE-2026-109108 and CVE-2026-113802 on the same model
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-109109 vuldb.com
- VulDB vulnerability 416860 vuldb.com
- Third-party PoC gist gist.github.com
- HOL Guard CVE-2026-109109 hol.org
- Wavlink WL-WN530BE1 product page www.wavlink.com
- Vulners CVE-2026-109109 vulners.com
- Strix CVE-2026-109109 www.strix.ai
- VulDB vulnerability 416859 (CVE-2026-109108) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:22.
Original description (NVD)
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.