Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-109109: Wavlink WL‑WN530BE1‑A can be crashed via settings export
CVE-2026-109109 · published 5 days ago
Summary
The router's web interface has a flaw in the Settings Export function that lets an attacker send a specially crafted request and cause the device to overflow its memory, potentially crashing or taking control of it. The problem can be triggered over the network without needing physical access. Update the router firmware to the latest version or disable the settings export feature until a fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wavlink | wl-wn530be1-a | 251117 |
Original advisory text
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta