Wavlink WL-WN530BE1-A CVE-2026-109108

Exploitation requires an authenticated low-privilege session on the Wavlink WL-WN530BE1-A web management interface (CVSS PR:L), from which the attacker issues a request to /cgi-bin/uploadVpn.cgi with a malicious 'Type' parameter that reaches a popen() call without sanitization, enabling shell command injection. LIMITING FACTORS: valid (even low-privilege) credentials or an active session are needed, and the attacker must have network reachability to the management interface - typically LAN-side unless remote/WAN management is enabled, which constrains internet-wide exploitation. No end-user interaction is required (UI:N). The practical barrier is weak: SOHO devices frequently ship with default or weak admin credentials, so the PR:L requirement is often trivially satisfied.

This is a genuine high-priority flaw for anyone running the affected device, but several signals should be weighed carefully. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H) describes a network-reachable, low-complexity OS command injection yielding full confidentiality, integrity and availability impact - i.e. complete device takeover. Crucially PR:L means exploitation requires authenticated low-privilege access, so this is NOT a pre-auth remote compromise; that meaningfully lowers mass-exploitation risk versus a PR:N bug. Exploitation status: publicly available exploit code exists (a public gist), and the E:P (Proof-of-Concept) exploit-maturity flag in the vector corroborates this; however this is NOT confirmed active exploitation - it is not listed in CISA KEV. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. SSVC-style read: exploitation = PoC (public code, not active), technical impact = total. The combination of a public PoC, low attack complexity and the typically weak credential posture of consumer/SOHO networking gear means the PR:L barrier is realistically defeatable (default or guessable admin credentials), so treat as a real patch priority for exposed devices, while recognizing the footprint of this specific Wavlink model is small.

An attacker with low-privilege access to the device's web management interface (or using default/guessed credentials) sends a crafted request to /cgi-bin/uploadVpn.cgi with a malicious 'Type' parameter that is passed into a popen() call, injecting shell metacharacters to execute arbitrary OS commands on the router. A public proof-of-concept exploit is available, lowering the skill needed to reproduce the attack. Given low attack complexity (AC:L), a successful request grants full command execution on the device.