CVE-2026-110957Critical· 10.0▾ AbyssalPoC availableA vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 55 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
3.5%
Exploit / PoC code exists
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109110Critical· 10.0A flaw has been found in Wavlink WL-WN592AX6 250422
CVE-2026-8230Medium· 6.3A flaw has been found in Wavlink NU516U1 240425
CVE-2026-8229Medium· 6.3A vulnerability was detected in Wavlink NU516U1 240425
CVE-2026-109108Critical· 9.9A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117
CVE-2026-113802Critical· 9.8Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
CVE-2026-110958Critical· 10.0A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724