Wavlink WL-WN530BE1-A: Unauthenticated OS command injection in ioos
Summary
The firmware of the Wavlink WL-WN530BE1-A router through M30BE1_V251117 contains an OS command injection in the ioos web management component. The login check can be bypassed by sending a forged IP-FROM: 127.0.0.1 header, so a remote attacker without credentials can run arbitrary commands as root. The attack requires only network access to the device's management interface.
Affected
- Wavlink WL-WN530BE1-A, firmware through M30BE1_V251117
Fixed in
Unknown. No vendor advisory or fixed firmware version has been published.
Workaround
- Remove the management interface from internet-facing paths (WAN exposure, port forwarding, remote management) and restrict it to a management VLAN or trusted LAN segment.
- Disable remote management and all unneeded services.
- Do not rely on the login page as a protection.
Exploitation
- A public proof of concept is reported (CISA SSVC: exploitation 'poc', automatable 'yes'); it has not been verified by us.
- Not listed in CISA KEV; no known exploitation in the wild.
- EPSS 0.0288 (low).
Our recommendation
- Inventory all WL-WN530BE1-A devices and record their firmware versions.
- Block access to the management interface from the internet and disable remote management now.
- Monitor for a vendor advisory or fixed firmware and verify any update against the affected range.
- If no fix is published, plan to replace the device.
- Check related CVE-2026-109108 and CVE-2026-109109 for the same product.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Researcher advisory (F-yyjy) on GitHub github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE record CVE-2026-113802 app.opencve.io
- Wavlink firmware update guide (FAQ) www.wavlink.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:04.
Original description (NVD)
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.