CVE-2026-110957 Details
Description
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
A vulnerability allowing unauthenticated OS command injection has been identified in the Wavlink WL-WN530BE2-A router, specifically in firmware versions prior to M30BE2_V250604. The issue arises in the 'api.cgi' file within the Login Processing component, particularly in the 'sub_12580' function. Exploitation involves manipulating the 'REMOTE_ADDR' environment variable to inject arbitrary shell commands, which are then executed with the privileges of the web server process. This vulnerability can be exploited remotely, leading to potential full system compromise.
Users are advised to upgrade to the Wavlink firmware version 2026-09-24-841a51c6d5_tclinux.bin, which addresses this vulnerability by removing the command injection flaw and implementing proper input validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin | [email protected] | Broken LinkVendor |
| https://github.com/F-yyjy/cve/blob/main/WN530BE2-A_api-cgi.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-110957 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/920217 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/420570 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/420570/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wavlink WL-WN530BE2-A | <= M30BE2_V250604 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |