Wavlink WL-WN530BE2-A CVE-2026-110957

The device must expose its web management interface (api.cgi) to the attacker, and the request must route through the vulnerable login path (api=info&client=app → sub_12580) on firmware up to M30BE2_V250604; fixed in build 2026-09-24-841a51c6d5. The concrete prerequisite is that the attacker can inject shell metacharacters into the value the firmware treats as REMOTE_ADDR (the client address). Key LIMITING factor: REMOTE_ADDR is conventionally derived from the TCP source address, which a normal client cannot populate with metacharacters - so realistic exploitation likely requires the web server to trust a client-supplied address header, or an on-path/proxy position; this materially narrows exploitability versus the pure AV:N/PR:N/UI:N reading and should be confirmed against the published PoC. No authentication is required per the CVSS vector (PR:N).

This is a genuine high-priority issue for anyone operating the affected device, but the signals are mixed on breadth of exploitation. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality/integrity/availability impact) describes a remote, unauthenticated OS command injection - the worst-case profile - and the vendor has confirmed the flaw (login script was built via system() with an unsanitized client address). A public exploit exists (VulDB/GitHub PoC) and the CVSS 4.0 E:P (Proof-of-Concept) subscore matches that. However, the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active, widespread exploitation - current status is 'publicly available exploit code exists', which is a distinct and lesser signal than active exploitation. A material caveat tempers the AC:L rating: the injected argument is REMOTE_ADDR, which on most embedded web servers is the raw TCP source address and therefore NOT trivially controllable with shell metacharacters by a normal remote client - practical exploitation may require the device to honor a client-supplied address header or an on-path/proxy position. This should be verified against the PoC before treating the flaw as fully drive-by. Net: treat as high priority for owners of this specific Wavlink model (patch available), but the real-world blast radius is constrained by the product's small deployment footprint, not yet by KEV-level mass exploitation.

A remote attacker reaches the device's web management interface and sends a request to the api.cgi login handler (api=info&client=app) whose client-address value carries shell metacharacters, which the vulnerable sub_12580 function passes into a system() call. A public proof-of-concept exists (GitHub F-yyjy/cve), so the attacker gains arbitrary OS command execution on the router firmware. Exploitation hinges on the attacker's ability to actually control the REMOTE_ADDR value used in the command.