Wavlink WL-WN530BE2-A Router Exposed to Remote Code Execution via Login Handler
Attackers could execute arbitrary commands remotely on this router by exploiting a flaw in how login requests process client addresses.
Key points
- The vulnerability allows remote command injection through the Login Processing component.
- Wavlink has released a firmware update that addresses the issue.
- The flaw affects devices running firmware up to version M30BE2_V250604.
Remote attackers can gain control over Wavlink WL-WN530BE2-A routers by exploiting a critical flaw in the login mechanism. This capability stems from improper handling of the REMOTE_ADDR argument within the api.cgi file. The vulnerability allows an adversary to inject operating system commands remotely.
How it unfolded
- The flaw was identified in the sub_12580 function of the Login Processing component.
- Public disclosure of the exploit details occurred, making the technique available to adversaries.
- Wavlink confirmed the finding and released a patched firmware version.
Who is affected
Organizations and individuals using the Wavlink WL-WN530BE2-A router are at risk if they have not updated their firmware. Specifically, devices running firmware version M30BE2_V250604 or earlier are vulnerable to this remote code execution attack. The vulnerability is rated as Critical by the National Vulnerability Database, indicating severe potential impact on device integrity and network security.
The fix
Wavlink has released a firmware update that resolves this vulnerability. The recommended version is 2026-09-24-841a51c6d5_tclinux.bin. Users should apply this update immediately to restore secure handling of login requests. The vendor confirmed that the fix involves changing how the login script is invoked, eliminating the command injection vector.
What made it possible
This class of vulnerability arises when software constructs system commands using untrusted input without proper sanitization. It typically serves the initial access stage of an intrusion, allowing attackers to bypass network boundaries. Security teams usually check whether applications execute shell commands directly with user-supplied data. Mitigation involves using safer execution methods that separate commands from arguments, preventing input from being interpreted as executable code.
What to do and how to stay safe: Wavlink
- Verify current firmware versions on all Wavlink WL-WN530BE2-A devices.
- Apply the latest firmware update provided by the vendor.
- Monitor network traffic for unusual outbound connections or commands.
- Segment guest networks to limit lateral movement if a device is compromised.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-110957 as Critical with a CVSS score of 10.
Is there a specific firmware version that fixes this issue?
Yes, upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue.
Can this vulnerability be exploited remotely?
Yes, the exploit has been disclosed to the public and can be initiated remotely.
