CVE-2026-120198
Remote command injection in WAVLINK WL-WN530BE1-A V251117
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
WAVLINK WL-WN530BE1-A firmware V251117 has a command injection flaw in con_check_read_finish in /protocol.csp. An unauthenticated remote attacker can trigger it by manipulating the group_name or IP-FROM argument, with no user interaction. Successful exploitation can run commands on the device. A public exploit has been disclosed.
What to do: WAVLINK has not listed a fixed version; the vendor was contacted about the disclosure. No workaround is named.
| Product | Affected |
|---|---|
| WAVLINK WL-WN530BE1-A | V251117 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
- Weakness
- CWE-74, CWE-77
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.