CVE-2026-113802 Wavlink CVE debrief

Who should care

Defenders responsible for Wavlink WL-WN530BE1-A systems, particularly those using firmware version M30BE1_V251117, should prioritize patching or mitigating this vulnerability. Network administrators and security teams overseeing network devices and firmware should assess exposure and implement compensating controls if patches are not immediately available.

Why it matters

CVE-2026-113802 is a critical vulnerability in Wavlink WL-WN530BE1-A firmware that allows unauthenticated OS command injection. Defenders should prioritize patching or applying compensating controls due to the high risk of exploitation and potential for system compromise.

• Unauthenticated OS command injection allows for arbitrary command execution as root, potentially leading to complete system compromise.
• Successful exploitation could enable attackers to bypass login mechanisms and gain unauthorized access to system resources.
• The vulnerability's critical CVSS score of 9.3 indicates a high likelihood of exploitation and significant potential impact.
• Verification of system configurations and inventory checks are necessary to determine exposure.

Technical summary

The vulnerability exists in the sub_23B54 function of the ioos binary in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117. This function fails to properly sanitize the file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del, allowing for OS command injection. An unauthenticated attacker can exploit this by sending a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

Defensive priority

Immediate attention is required for systems using the affected Wavlink WL-WN530BE1-A firmware. Defenders should verify if their systems are using the vulnerable version M30BE1_V251117 and prioritize patching or applying compensating controls.

Recommended defensive actions

• Verify if systems are using the vulnerable firmware version M30BE1_V251117.
• Apply patches or updates provided by the vendor if available.
• Implement compensating controls such as restricting access to the affected systems or monitoring for suspicious activity.
• Review network configurations and segmentation to limit potential attack paths.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in the ioos binary's sub_23B54 function and the potential for unauthenticated OS command injection. However, specific details about exploitation or affected systems beyond the mentioned firmware version are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.