CVE-2026-120198 is a critical, remotely exploitable command injection flaw in the WAVLINK WL-WN530BE1-A firmware V251117, and a public exploit has been disclosed.
What Is It
The flaw is in the con_check_read_finish function of the /protocol.csp file on the WAVLINK WL-WN530BE1-A. An attacker can manipulate the group_name/IP-FROM argument to inject commands. The weakness is classified as CWE-74 (Injection) and CWE-77 (Command Injection).
VulDB, the CVE Numbering Authority (CNA), published the record on 2026-11-01. Its NVD status is "Received," which means NVD has not yet completed its own analysis.
Why It Matters
The CNA scores this flaw at the top of the severity scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity marked as Proof-of-Concept
- CVSS 2.0: 10.0
The attack works over the network and has low complexity. It needs no privileges and no user action. A successful attack has high impact on confidentiality, integrity and availability. The CVSS 3.1 scope is "Changed," so the impact can reach beyond the vulnerable component.
According to the CNA, the exploit has been publicly disclosed and may be used. The supplied CISA KEV data contains no entry for this CVE, so KEV does not currently confirm active exploitation. Even so, a public exploit for an unauthenticated, network-reachable flaw should be treated as urgent.
What's Vulnerable
- Vendor: WAVLINK
- Product: WL-WN530BE1-A
- Affected version: V251117
- CPE:
cpe:2.3:a:wavlink:wl-wn530be1-a:*:*:*:*:*:*:*:*
The supplied record lists no other affected versions.
Patch Status
The supplied NVD record gives no fixed version, patch or vendor advisory. The CNA says the vendor was contacted early about this disclosure. It does not say whether the vendor responded. Because there is no KEV entry, there is no CISA required action or due date.
Until a fix is confirmed:
- Find any WL-WN530BE1-A devices running V251117.
- Check the VulDB and researcher references below for updates.
- Limit network exposure of the device's management interface.