CVE-2026-120198 in WL-WN530BE1-A
Summary
by MITRE • 11/01/2026
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The WAVLINK WL-WN530BE1-A V251117 wireless router contains a critical security flaw within its web management interface, specifically located in the con_check_read_finish function found in the /protocol.csp file. This vulnerability stems from an improper neutralization of special elements used in an operating system command, commonly known as OS Command Injection. The root cause is identified as CWE-78, which describes a situation where software constructs part or all of an OS command using externally-influenced input without sufficiently removing dangerous elements. In this specific instance, the flaw involves the manipulation of the group_name and IP-FROM arguments passed to the function. These parameters are intended for legitimate administrative tasks but lack adequate sanitization before being incorporated into system-level commands executed by the router's firmware.
The technical mechanism of exploitation relies on the attacker providing specially crafted input that includes shell metacharacters such as semicolons, pipes, or backticks. When the vulnerable function processes these inputs without proper validation or escaping, it inadvertently passes them to a command interpreter like sh or bash. This allows an unauthenticated remote attacker to execute arbitrary commands with the privileges of the application process running on the device. Since this vulnerability exists in a network-facing component accessible via HTTP requests, it is classified as CWE-209 regarding the generation of error messages containing sensitive information if the execution fails, but more critically as CWE-78 for the injection itself. The presence of this flaw significantly expands the attack surface of the router, allowing attackers to bypass standard authentication mechanisms entirely by interacting directly with the underlying command interpreter through the web interface parameters.
The operational impact of this vulnerability is severe and multifaceted. Because the commands are executed on the device, an attacker can gain full control over the compromised system. This includes the ability to read sensitive configuration files, modify network settings such as DNS or firewall rules, install persistent backdoors for long-term access, or use the router as a pivot point for further attacks against devices within the local network. The vulnerability is associated with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques like sh (T1059.004) which are commonly used in IoT device compromises to automate post-exploitation activities. Furthermore, it aligns with the initial access vector of Exploit Public-Facing Application under MITRE ATT&CK T1190, highlighting how publicly accessible services serve as entry points for malicious actors targeting Internet of Things infrastructure.
Given that the exploit has been disclosed to the public and is actively available for use, immediate mitigation actions are required beyond waiting for a vendor patch. Network administrators should prioritize isolating affected devices from untrusted networks or restricting access to the management interface via IP whitelisting if possible. If remote administration is not strictly necessary, it should be disabled entirely through physical reset procedures followed by reconfiguration with strong credentials and updated firmware once available. Users must also ensure that default passwords are changed immediately, although this specific vulnerability bypasses authentication so credential strength alone does not mitigate the risk. Continuous monitoring of network traffic for anomalous outbound connections from IoT devices can help detect potential compromise resulting from successful exploitation of this command injection flaw.