Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Wavlink WL‑WN530BE2‑A router allows remote command execution

CVE-2026-110957 · published today
Summary

The login page of the WL‑WN530BE2‑A router can be tricked into running any command the attacker supplies, letting a remote user take control of the device. This problem exists in firmware up to version M30BE2_V250604 and can be exploited over the network. Install the newer firmware version released on 2026‑09‑24 (2026-09-24-841a51c6d5_tclinux.bin) to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wavlink wl-wn530be2-a M30BE2_V250604
Original advisory text
Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-110957 · NVD
CVE-2026-110957 · MITRE
Track software like this
Free during beta