Wl Wn530Be2 A
Monthly
OS command injection in Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604 lets remote attackers reach the api.cgi login handler (api=info&client=app, function sub_12580) and inject shell metacharacters through the value the firmware treats as the client address (REMOTE_ADDR), potentially yielding arbitrary command execution with root-level privileges on the device. The vendor has confirmed the finding and shipped a fix in firmware 2026-09-24-841a51c6d5_tclinux.bin, which replaces the system() call with execvp and length-limits/null-checks the client address; publicly available exploit code exists (a GitHub PoC), though the weakness is not confirmed as actively exploited (CISA KEV). Exploitation is not as trivial as the raw CVSS 4.0 score of 9.3 implies: REMOTE_ADDR is conventionally derived from the TCP source address, so a real-world attacker likely needs the web server to trust a client-supplied address header or needs an on-path/proxy position, which materially narrows the population of reachable targets despite PR:N in the published vector.
OS command injection in Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604 lets remote attackers reach the api.cgi login handler (api=info&client=app, function sub_12580) and inject shell metacharacters through the value the firmware treats as the client address (REMOTE_ADDR), potentially yielding arbitrary command execution with root-level privileges on the device. The vendor has confirmed the finding and shipped a fix in firmware 2026-09-24-841a51c6d5_tclinux.bin, which replaces the system() call with execvp and length-limits/null-checks the client address; publicly available exploit code exists (a GitHub PoC), though the weakness is not confirmed as actively exploited (CISA KEV). Exploitation is not as trivial as the raw CVSS 4.0 score of 9.3 implies: REMOTE_ADDR is conventionally derived from the TCP source address, so a real-world attacker likely needs the web server to trust a client-supplied address header or needs an on-path/proxy position, which materially narrows the population of reachable targets despite PR:N in the published vector.