Wl Wn530Be1 A
Monthly
Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.
Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.