CVE-2026-113802

CRITICAL 9.8

Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

CWE	CWE-78
Vendor	wavlink
Product	wl-wn530be1-a
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for wavlink wl-wn530be1-a

Be the first to know when new critical vulnerabilities affecting wavlink wl-wn530be1-a are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Wavlink / WL-WN530BE1-A

M30BE1_V251117

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/F-yyjy/cve/blob/main/WN530BE1(en).md vulncheck.com: https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler

Credits

F-yyjy