Zero Radar
← feed
CriticalVulnerabilityCVE-2026-113802updated 25 Oct 2026, 15:20 UTC

Wavlink WL-WN530BE1-A router lets attackers run commands without login

Attackers on the network can trick this Wi-Fi router into running commands as its administrator, without any password. That gives them full control of the device.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or password needed
  2. 2Forged headerFake IP-FROM 127.0.0.1 bypasses login
  3. 3Router requestfile_id sent to /protocol.csp
  4. 4Command injectionUnsanitized input passed to popen()
  5. ResultAttacker runs commands as root

What happened

OS command injection in the sub_23B54 function of the ioos binary: the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file (type=del) is passed to popen(), and a forged 'IP-FROM: 127.0.0.1' header bypasses authentication, allowing arbitrary commands as root.

Why it is dangerous: An unauthenticated attacker can take over the router as root, potentially intercepting or redirecting traffic of everyone using it and using it as a foothold into the home or office network.

Are you affected?

You are affected if you run Wavlink WL-WN530BE1-A with firmware through M30BE1_V251117.

Wavlink WL-WN530BE1-A, firmware through M30BE1_V251117

What to do

  1. Check your router's firmware version in its admin page and compare it with M30BE1_V251117.
  2. Check the vendor's website for a firmware update newer than M30BE1_V251117 and install it if available.
  3. If no fix is available, restrict access to the router's admin interface and disable remote management until a patch is released.

Timeline

  1. 20 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-113802 · GHSA-j6fh-9747-5rv9
CVSS
9.3 / 10
EPSS
3.5% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Wavlink WL-WN530BE1-A router lets attackers run commands without login · Zero Radar