Wavlink WL-WN530BE2-A: OS command injection in Login Processing api.cgi
Summary
Wavlink WL-WN530BE2-A devices with firmware up to M30BE2_V250604 contain an OS command injection in the login processing function (sub_12580) of the api.cgi handler. The value of REMOTE_ADDR is passed unvalidated into a shell command executed via system(). The attack can be started remotely, and according to a public write-up without authentication, and a proof of concept is public. The vendor states that the issue is fixed in newer firmware.
Affected
- Wavlink WL-WN530BE2-A, firmware M30BE2_V250604 and earlier
- Variant WL-WN530BE2-B: Unknown.
Fixed in
- Firmware 2026-09-24-841a51c6d5_tclinux.bin (vendor-confirmed fix, according to VulDB)
Workaround
- No vendor workaround known.
- Unknown.
Exploitation
- Public proof of concept available (VulDB status: Proof-of-Concept; CISA SSVC: Exploitation poc, automatable yes).
- No evidence of in-the-wild exploitation found; not listed in KEV.
- EPSS low (around 0.03).
Our recommendation
- Confirm that the device model is exactly WL-WN530BE2-A (not a similar model) and check the firmware version.
- Update to firmware 2026-09-24-841a51c6d5_tclinux.bin or later, using the vendor download page.
- Remove internet exposure of the management and login interface and disable remote management.
- Restrict access to the admin interface to the internal network.
- Replace the device if the vendor no longer provides updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wavlink firmware download (fixed version) dl.wavlink.com
- VulDB CVE entry vuldb.com
- VulDB vulnerability entry 420570 vuldb.com
- Technical write-up (GitHub) github.com
- OpenCVE entry app.opencve.io
- Wavlink manuals page www.wavlink.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:37.
Original description (NVD)
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.