CVE-2026-113802 is a critical OS command injection flaw (CVSS 3.1 9.8) in Wavlink WL-WN530BE1-A firmware: a remote attacker with no credentials can bypass login and run arbitrary commands as root.
What Is It
The flaw is in the sub_23B54 function of the device's ioos binary. That function takes the file_id parameter from /protocol.csp?opt=ovpn_file requests with type=del and passes it to popen() without sanitizing it. This is CWE-78, OS command injection.
On its own, the injection would sit behind the login. But according to the NVD description, an attacker can send a forged IP-FROM: 127.0.0.1 header to bypass authentication. Together, the two weaknesses give a remote attacker unauthenticated command execution as root.
VulnCheck disclosed the vulnerability, and NVD published it on 2026-10-20. NVD lists its analysis status as "Deferred."
Why It Matters
VulnCheck scores this flaw at the top of the severity range:
- CVSS 3.1: 9.8 Critical (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 Critical
Both vectors mean the attack works over the network, is easy to carry out, needs no privileges and needs no user interaction. Confidentiality, integrity and availability impacts are all high. Because commands run as root, a successful attacker gets full control of the device.
Exploitation status: The CVE has no entry in the CISA Known Exploited Vulnerabilities catalog, so CISA has not confirmed active exploitation. The CVSS 4.0 exploit maturity field is also "Not Defined." A public technical write-up is listed in the references.
What's Vulnerable
- Vendor: Wavlink
- Product: WL-WN530BE1-A
- Affected firmware: versions through
M30BE1_V251117
The CVE record lists no CPE entries.
Patch Status
The NVD and KEV data do not include a fixed firmware version, a vendor advisory, or a CISA-required action. The source material does not identify a patch.
Until Wavlink publishes a fix, owners of affected devices should keep an eye on Wavlink and VulnCheck for updates. They should also review the VulnCheck advisory below for any guidance it contains.