CVE-2026-113802 in WL-WN530BE1-A
Summary
by MITRE • 10/20/2026
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Wavlink WL-WN530BE1-A firmware versions prior to M30BE1_V251117 represents a critical security flaw rooted in improper input validation within the device's web management interface. Specifically, the issue resides in the sub_23B54 function of the ioos binary, which handles requests directed at /protocol.csp?opt=ovpn_file with the type parameter set to del. This component is responsible for managing OpenVPN configuration files on the router. The core technical failure involves the direct passing of an unsanitized file_id parameter into a popen() system call. Because the input is not adequately filtered or escaped before being executed by the operating system shell, it allows for OS command injection attacks. This type of flaw falls squarely under CWE-78 Improper Neutralization of Special Elements used in an OS Command and aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where attackers leverage native tools to execute arbitrary commands on the target system.
The operational impact of this vulnerability is severe due to two compounding factors: authentication bypass and privilege escalation. The firmware contains a logic flaw that permits an attacker to bypass login mechanisms by forging the IP-FROM header with the value 127.0.0.1. This spoofing technique tricks the application into believing the request originates from localhost, thereby granting access without valid credentials. Once this authentication barrier is circumvented, the subsequent command injection allows a remote unauthenticated attacker to execute arbitrary commands with root privileges. The use of popen() means that any shell metacharacters present in the file_id parameter are interpreted by the underlying OS shell, enabling full system compromise. An adversary can leverage this access to install persistent backdoors, exfiltrate sensitive network data, modify routing tables, or pivot into other devices on the internal LAN.
Mitigation strategies must address both the immediate exploitation vector and the underlying architectural weaknesses. The primary remediation is to apply the firmware update M30BE1_V251117 or any later version released by Wavlink that patches this specific flaw. For environments where updating is not immediately feasible, network-level controls should be implemented to restrict access to the router's management interface exclusively from trusted IP addresses and disable remote administration features if they are not required. Additionally, input validation must be enforced at the application layer; developers should ensure that all user-supplied data passed to system functions like popen() is strictly validated against a whitelist of allowed characters or properly escaped using language-specific sanitization libraries. Regular security audits focusing on command injection vulnerabilities in embedded devices are essential to prevent similar issues in future firmware releases.