WAVLINK WL-WN530BE1-A: Command injection in protocol.csp
Summary
The WAVLINK WL-WN530BE1-A router with firmware V251117 contains a command injection flaw in the function con_check_read_finish of /protocol.csp. The group_name parameter is passed unsanitized to a shell command, and the IP-FROM HTTP header can be forged as 127.0.0.1 to skip the login check. A remote attacker with network access can run arbitrary commands as root without credentials. A public proof of concept exists, and the vendor has not published a fix.
Affected
- WAVLINK WL-WN530BE1-A, firmware V251117 (the only version listed)
- Other firmware versions: Unknown.
Fixed in
Unknown. No fixed firmware has been identified.
Workaround
- No vendor-published workaround.
- Keep the web management interface off the internet and place it behind a VPN or an authenticating reverse proxy (third-party advice, not vendor guidance).
Exploitation
- A public proof of concept is available. VulDB lists it as Proof-of-Concept, remote.
- No evidence of in-the-wild exploitation was found as of 1 Nov 2026.
Our recommendation
- Check the firmware version on every WL-WN530BE1-A device.
- Remove internet exposure of the management interface and restrict access to trusted networks or a VPN.
- Monitor for unexpected requests to /protocol.csp and check devices for unknown files or accounts.
- Plan to replace the device if no fixed firmware is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120198 vuldb.com
- VulDB vulnerability 429561 vuldb.com
- Proof of concept (GitHub, third party) github.com
- Vulners CVE-2026-120198 vulners.com
- OffSeq threat radar entry radar.offseq.com
- Third-party analysis of related CVE (mitigation advice) dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:20.
Original description (NVD)
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.