WAVLINK WL-WN530BE1-A CVE-2026-120198

Exploitation requires network reachability to the WAVLINK WL-WN530BE1-A (build V251117) management interface serving /protocol.csp, and the ability to send a request that reaches the con_check_read_finish function with attacker-controlled group_name or IP-FROM values. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated as required. The practical limiting factor is exposure of the device's web/management service: risk is highest where that interface is reachable from untrusted networks (e.g. WAN-exposed or flat LANs), and substantially lower where management access is restricted to a trusted segment. The description does not state how the injection is triggered beyond naming the affected function and arguments.

All severity signals point one direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, with high impact to confidentiality, integrity and availability, and the vuln.today decision label is 'act_now'. CWE-77 command injection on a router's web protocol endpoint means device takeover, which is why impact is rated high across the board. The tempering factors are source and maturity: the only reporter is VulDB, there is no CISA KEV listing and no EPSS probability was supplied, so widespread automated exploitation is not yet evidenced. The exploit maturity in the vector is E:P (proof-of-concept), consistent with the input stating a PoC reference exists that is not verified as working exploit code. Net: a genuinely high-severity, easily-reachable flaw whose 'act_now' urgency is justified by its trivial exploitation profile rather than by confirmed mass exploitation - treat as high priority for anyone running this device, while recognizing the real-world exploitation volume is currently unquantified (no EPSS, no KEV).

An attacker with network reach to the router's management interface sends a crafted request to /protocol.csp targeting the con_check_read_finish function, injecting shell metacharacters into the group_name or IP-FROM argument to run arbitrary OS commands on the device. Because the supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is indicated, making exploitation straightforward where the interface is reachable. A public PoC reference exists (GitHub), though it is not verified as working exploit code.