Wavlink WL-WN530BE1-A CVE-2026-109109

Exploitation requires network access to the device's management web server and the ability to send an HTTP request to the specific endpoint /cgi-bin/ExportAllSettings.cgi (the Settings Export CGI component) with an attacker-controlled, oversized X-Cmd value in the HTTP Cookie header. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are needed, so it works against default configurations where the CGI is reachable. The principal limiting factor is reachability: exploitation is constrained to attackers who can reach the router's HTTP interface - trivial on the LAN or when remote/WAN-side management is exposed, but not exploitable if the management interface is not network-accessible to the attacker. It is also specific to the WL-WN530BE1-A model at build 251117.

Multiple signals point to genuinely high risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction, and the E:P (Proof-of-Concept) exploit-maturity value aligns with the confirmed public POC on GitHub Gist. A stack-based buffer overflow (CWE-121) reached through the HTTP_COOKIE/X-Cmd header of a CGI binary is a classic path to remote code execution on embedded router firmware, which justifies the 9.3 score and the VC:H/VI:H/VA:H impact ratings. Countervailing factors temper the real-world urgency: this is NOT on CISA KEV (no confirmed active exploitation), and no EPSS probability was supplied, so widespread automated exploitation cannot be asserted. The only sourcing is VulDB (a single aggregator) with no independent vendor advisory. Note also that the input 4.0 vector asserts subsequent-system impact (SC:H/SI:H/SA:H); for a self-contained router CGI this scope escalation is not clearly supported by the description and should be verified. Net: a real priority for anyone running this specific device (unauthenticated remote RCE with public exploit code), but exploitation is currently POC-stage rather than confirmed in-the-wild, and the affected product has a narrow footprint.

An attacker with network reachability to the router's web interface sends a single crafted HTTP request to /cgi-bin/ExportAllSettings.cgi carrying an oversized X-Cmd value in the Cookie header, overflowing a stack buffer in a strcpy call and hijacking control flow to execute attacker code on the device. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and only low complexity are required. Publicly available exploit code exists (GitHub Gist referenced by VulDB), lowering the barrier to reproduction.