Wavlink WL-WN530BE2-A up to M30BE2_V250604 Login Processing api.cgi sub_12580 REMOTE_ADDR os command injection

Summaryinfo

A vulnerability labeled as very critical has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The impacted element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR results in os command injection. This vulnerability is known as CVE-2026-110957. It is possible to launch the attack remotely. Furthermore, an exploit is available. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

Detailsinfo

A vulnerability classified as very critical has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. Affected is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-110957. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/15/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin eliminates this vulnerability. The upgrade is hosted for download at dl.wavlink.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Wavlink

Name

• WL-WN530BE2-A

Version

• M30BE2_V250604

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #920217: Wavlink WL-WN530BE2-A M30BE2_V250604 CWE-78 (by yyjy)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion