Wavlink WL-WN530BE1-A EUVD-2026-105226

Exploitation requires network reachability to the device's web management service (/protocol.csp handler in the ioos binary) and an HTTP request to opt=ovpn_file with type=del carrying a malicious file_id value. The critical enabling condition is the authentication-bypass flaw: the device trusts a client-supplied 'IP-FROM: 127.0.0.1' header as proof of localhost origin, so an attacker simply forges that header to defeat login - no credentials, no user interaction, and the device's default web interface is sufficient. The main limiting factor is exposure: the attacker must be able to reach the device's HTTP interface (LAN-adjacent, or WAN-exposed if remote management is reachable), and the target must run firmware at or below M30BE1_V251117. No special non-default configuration is needed beyond the device operating normally.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - and the description corroborates every one of those metrics: a remote attacker forges an 'IP-FROM: 127.0.0.1' header to bypass login and reaches popen() as root. The signals are internally consistent rather than conflicting. A public POC exists (hosted on GitHub and referenced by VulnCheck), which materially raises the likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score in the provided data, so active in-the-wild exploitation is not confirmed and real-world exploitation volume cannot be quantified from these inputs. The practical risk ceiling is strongly moderated by product prevalence: this is a niche consumer Wi-Fi range extender, so widespread automated mass-exploitation is less likely than targeted or botnet-style scanning of exposed devices. Net: treat as urgent for any environment that actually runs this device with its web interface exposed, while recognizing the limited deployment footprint.

A remote, unauthenticated attacker sends a single crafted HTTP request to /protocol.csp?opt=ovpn_file with type=del, including a forged 'IP-FROM: 127.0.0.1' header to defeat the login check, and embeds shell metacharacters in the file_id parameter that the ioos binary passes unsanitized to popen(). Because execution occurs as root, the attacker gains full device takeover from one request. A public proof-of-concept is already available, so weaponization effort is minimal and the attack can be scripted against internet- or LAN-exposed devices.