CVE-2026-109109 in WL-WN530BE1-A
Summary
by MITRE • 10/13/2026
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Wavlink WL-WN530BE1-A router, specifically firmware version 251117, contains a critical security flaw within its web management interface that allows for remote code execution through stack-based buffer overflow techniques. This vulnerability is located in the Settings Export CGI component, which handles the export of device configuration data to administrators via the /cgi-bin/ExportAllSettings.cgi endpoint. The core technical issue stems from an improper implementation of memory handling functions, specifically the use of strcpy without adequate bounds checking when processing input derived from HTTP cookies.
The specific attack vector involves manipulating the X-Cmd argument within the HTTP_COOKIE header sent during a request to the export settings page. Because the application copies this untrusted user-supplied data into a fixed-size stack buffer using strcpy, it fails to verify whether the incoming string length exceeds the allocated memory space. When an attacker crafts a cookie value with sufficient payload size and carefully placed shellcode or return address overwrites, they can overwrite adjacent memory locations on the call stack. This manipulation allows for arbitrary code execution by redirecting the program flow to malicious instructions injected into the buffer.
This vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input, and aligns with ATT&CK technique T1190, Exploit Public-Facing Application. The severity is heightened by the fact that this component is accessible remotely over standard HTTP or HTTPS protocols, meaning no prior authentication is necessarily required to trigger the initial overflow if the web interface allows anonymous access to export functions or if session cookies can be manipulated pre-authentication in certain configurations. Even if authentication is required, the ability to execute code with the privileges of the CGI process often grants attackers full control over the embedded Linux system running on the router.
The operational impact of this vulnerability is severe and comprehensive. Successful exploitation enables an attacker to gain root-level access to the device, bypassing all intended security controls. This level of compromise allows for complete interception of network traffic, modification of DNS settings to facilitate phishing or man-in-the-middle attacks, installation of persistent backdoors such as Mirai variants, and use of the compromised router as a pivot point for further lateral movement within the local network. Given that routers are often gateways between private networks and the internet, this vulnerability poses significant risks to data confidentiality, integrity, and availability across connected devices.
Mitigation strategies must prioritize immediate remediation through vendor-provided firmware updates if available, ensuring all instances of Wavlink WL-WN530BE1-A running version 251117 are upgraded to a patched release that implements proper input validation and uses safer string handling functions like strncpy or snprintf with explicit length limits. In the absence of an immediate patch, network-level controls should be employed to restrict access to the management interface from untrusted networks, disabling remote administration features entirely where possible. Additionally, implementing Web Application Firewalls (WAF) rules that detect abnormal cookie sizes and specific string patterns associated with buffer overflow attempts can provide a temporary layer of defense against exploitation until permanent fixes are deployed.