CVE-2026-113802: wavlink wl-wn530be1-a OS Command Injection

CVSS: 9.8v3.1CriticalDeferred

Published 20-10-2026Last modified 20-10-2026

Vulnerability summary

CVE-2026-113802 is a critical (CVSS 9.8) OS Command Injection vulnerability in wavlink wl-wn530be1-a. 1 public exploit is recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Timeline

20-10-2026
PublishedVulnerability first disclosed.

Description

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.09.3v3.19.8

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Cve
Maturity: poc

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Wavlink1 product

wl-wn530be1-aM30BE1_V251117

1 vendor · 1 product

References

2 links

github.com/F-yyjy/cve/blob/main/WN530BE1(en).mdThird Party AdvisoryExploit
www.vulncheck.com/advisories/…Third Party Advisory