CVE-2026-110957
Received Received - Intake

Command Injection in Wavlink WL-WN530BE2-A

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulDB

Description
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-110957
EUVD
EUVD-2026-102100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wavlink WL-WN530BE2-A M30BE2_V250604

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Remote Command Injection (RCE) vulnerability in the Wavlink WL-WN530BE2-A router's api.cgi component. The flaw allows attackers to inject arbitrary shell commands by manipulating the REMOTE_ADDR variable, which is used unsafely in a system call. The vulnerability is triggered via crafted GET requests to /cgi-bin/api.cgi without authentication.

Detection Guidance

To detect this vulnerability, check for unauthorized system command execution attempts via the api.cgi endpoint. Monitor network traffic for GET requests to /cgi-bin/api.cgi with parameters like api=info and client=app. Inspect logs for suspicious REMOTE_ADDR manipulations or unexpected shell commands.

Impact Analysis

An attacker could execute commands with the web server's privileges, leading to privilege escalation, data breaches, service disruption, or persistence by implanting backdoors. The high CVSS scores (9.3-10.0) indicate severe impact.

Mitigation Strategies

Immediately upgrade the affected Wavlink WL-WN530BE2-A device to firmware version 2026-09-24-841a51c6d5_tclinux.bin or later. Disable remote access to the api.cgi endpoint if not required. Implement network segmentation to isolate the device. Monitor for signs of exploitation or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart