CVE-2026-109108 is a critical OS command injection flaw in the /cgi-bin/uploadVpn.cgi endpoint of Wavlink WL-WN530BE1-A firmware 251117, and a public exploit has been released.
What Is It
The flaw is in how the popen function is called from /cgi-bin/uploadVpn.cgi on the Wavlink WL-WN530BE1-A. If an attacker manipulates the Type argument, the device runs OS commands of the attacker's choosing. The CNA (VulDB) classifies it as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The attack works remotely over the network. It has low attack complexity and needs no user interaction. It does require low-level privileges (PR:L), so an attacker needs some form of authenticated access first.
Why It Matters
VulDB rates the flaw as follows:
- CVSS 3.1: 9.9 CRITICAL (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The scope is changed, and the impact on confidentiality, integrity and availability is high. - CVSS 4.0: 8.6 HIGH, with exploit maturity marked as Proof-of-Concept.
- CVSS 2.0: 9.0 HIGH.
According to the advisory, "the exploit has been disclosed publicly and may be used." A public write-up is linked from the NVD references. That lowers the bar for exploitation, even though only low privileges are needed in the first place.
KEV status: CVE-2026-109108 is not in the CISA Known Exploited Vulnerabilities catalog. KEV does not confirm active exploitation, and no CISA required action or due date applies.
What's Vulnerable
- Vendor: Wavlink
- Product: WL-WN530BE1-A
- Affected version: 251117
- CPE:
cpe:2.3:a:wavlink:wl-wn530be1-a:*:*:*:*:*:*:*:*
The source data names no other versions or models. NVD lists the record's status as "Deferred," which means NVD has not added its own analysis on top of the CNA data.
Patch Status
The source data has no patch, fixed firmware version or vendor advisory. The disclosure says only that "the vendor was contacted early about this disclosure"; it does not say whether the vendor responded or released a fix.
Until Wavlink confirms a fix, owners of WL-WN530BE1-A devices on firmware 251117 should:
- treat the device as exposed
- restrict access to its management interface, especially from untrusted networks
- watch Wavlink for updated firmware