Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120198updated 1 Nov 2026, 06:36 UTC

WAVLINK WL-WN530BE1-A router: remote command injection flaw

Someone on the network could send a specially crafted request to this router and make it run commands they choose. Public exploit code exists, so attacks are possible.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted input sent to /protocol.csp
  2. 2Request reaches routerReachable remotely if exposed
  3. 3Input not sanitizedgroup_name or IP-FROM passed unchecked
  4. 4Injected command runsCommand executes on the device
  5. ResultAttacker can run commands on router

What happened

In WAVLINK WL-WN530BE1-A firmware V251117, the function con_check_read_finish in /protocol.csp does not properly handle the group_name or IP-FROM argument, allowing command injection that can be triggered remotely.

Why it is dangerous: An attacker who reaches the router could take control of it, which could expose or redirect traffic on the network it serves. Home and small-office users with this model are at risk.

Are you affected?

You are affected if you run WAVLINK WL-WN530BE1-A with firmware V251117 and its web interface (/protocol.csp) is reachable from an untrusted network.

WAVLINK WL-WN530BE1-A, firmware V251117

What to do

  1. Check the WAVLINK support site for a firmware update that fixes this issue, and install it if one is available
  2. Turn off remote management and block access to the router's web interface from the internet
  3. Change the router's admin password to a strong, unique one

Timeline

  1. 1 Nov 2026, 05:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 05:18 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 06:23 UTC
    Picked up by Zero Radar
  4. 1 Nov 2026, 06:36 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120198 · GHSA-cq8m-m2p5-jxxm
CVSS
9.3 / 10
Disclosed
1 Nov 2026, 05:18 UTC
On Zero Radar
1 Nov 2026, 06:23 UTC (1 h after disclosure)
Last change
1 Nov 2026, 06:36 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WL-WN530BE1-A router: remote command injection flaw · Zero Radar