A critical OS command injection flaw in the Login Processing component of Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604 can be triggered remotely without authentication, and a public exploit has been disclosed.
What Is It
CVE-2026-110957 is an OS command injection vulnerability (CWE-77, CWE-78) in the sub_12580 function of api.cgi, inside the device's Login Processing component. An attacker can manipulate the REMOTE_ADDR argument to inject operating system commands. VulDB is the CNA, and the record was published to NVD on 2026-10-15.
Why It Matters
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
An attacker can exploit this over the network with low complexity. No privileges or user interaction are required. The CVSS 3.1 vector has a changed scope, and confidentiality, integrity and availability impacts are all High. The CNA says the exploit "has been disclosed to the public and may be used," and a public write-up is linked in the references.
This CVE has no CISA KEV entry, so KEV does not currently confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: Wavlink
- Product: WL-WN530BE2-A
- Component: Login Processing (
api.cgi, functionsub_12580) - Affected: firmware versions up to and including M30BE2_V250604
- Unaffected: 2026-09-24-841a51c6d5_tclinux.bin
- CPE:
cpe:2.3:a:wavlink:wl-wn530be2-a:*:*:*:*:*:*:*:*
Patch Status
A fix is available. The advisory says upgrading to firmware version 2026-09-24-841a51c6d5_tclinux.bin is enough to fix the issue, and it recommends upgrading the affected component. Wavlink has published the firmware image on its download server (linked below). Because there is no KEV entry, CISA has not issued a required action or due date for this CVE.