Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-109109 2026-10-13

Wavlink WL-WN530BE1-A Settings Export CGI Flaw Enables Remote Stack Overflow (CVE-2026-109109)

"CVE-2026-109109 is a critical stack-based buffer overflow in the Settings Export CGI of Wavlink WL-WN530BE1-A firmware version 251117. It can be triggered remotely, and a public exploit is available."

CVE-2026-109109 is a critical stack-based buffer overflow in the Settings Export CGI of Wavlink WL-WN530BE1-A firmware version 251117. It can be triggered remotely, and a public exploit is available.

What Is It

The flaw is in the /cgi-bin/ExportAllSettings.cgi file, which belongs to the device's Settings Export CGI component. According to the NVD description, the CGI passes the HTTP_COOKIE/X-Cmd argument to an unsafe strcpy call. An attacker who manipulates that argument can cause a stack-based buffer overflow.

The weaknesses are classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). VulDB, the CNA, published the CVE on 2026-10-13. NVD currently lists its status as "Deferred."

Why It Matters

VulDB rates this flaw at the top of the severity scale:

The attack works over the network, has low complexity, and needs no privileges or user interaction. A successful attack has high impact on confidentiality, integrity and availability, and the scope is rated as changed. The CNA states that "the exploit is now public and may be used," and a public write-up is linked in the references.

This CVE was not in CISA's Known Exploited Vulnerabilities catalog as of catalog version 2026.10.08, released 2026-10-08 (CISA KEV catalog). The source material does not confirm any active exploitation in the wild. A public exploit exists, but the only exploitation evidence is the proof of concept.

What's Vulnerable

The records list no other versions or products as affected.

Patch Status

The NVD record does not name a fixed version, a vendor advisory or a patch. The CNA says the vendor was contacted early about the disclosure, but the record does not mention any vendor response. Because there is no KEV entry, CISA has not issued a required action or a remediation deadline.

Owners of WL-WN530BE1-A devices running version 251117 should watch Wavlink for a firmware update. The exploit is public, so until a fix ships, any network exposure of the affected CGI endpoint carries the risk described above.

Sources