Organisations: Wavlink WL-WN530BE1-A Faces Critical CVSS 9.4 Risk from Public CGI Exploit Code
A critical vulnerability in Wavlink firmware enables remote attackers to execute operating system commands through a specific CGI script.
Key points
- The flaw affects Wavlink WL-WN530BE1-A devices running firmware version 251117.
- Researchers assigned a CVSS score of 9.4, rating the vulnerability as critical.
- Public exploit code for this issue is available and can be used by attackers.
Remote attackers can execute arbitrary operating system commands on Wavlink WL-WN530BE1-A routers running firmware version 251117. This capability stems from a command injection flaw in the uploadVpn.cgi script located in the device's cgi-bin directory. The vulnerability allows an attacker to manipulate the Type argument, leading to unauthorized code execution.
The risk
The National Vulnerability Database lists CVE-2026-109108 with a CVSS score of 9.4, classifying it as critical. Some records also list a high severity score of 8.6. The underlying weaknesses are identified as CWE-78 and CWE-77, which relate to improper neutralization of special elements in OS commands. The flaw involves the popen function within the CGI script.
Who is exposed
Only Wavlink WL-WN530BE1-A devices running firmware version 251117 are affected by this specific vulnerability. The attack can be performed remotely, meaning an attacker does not need physical access to the router. The exploit has been disclosed publicly, indicating that the code required to leverage this flaw is available for use by threat actors.
Cost and compliance
The vendor was contacted early regarding this disclosure. The public nature of the exploit means that automated scanning tools or attackers can identify and target vulnerable devices without needing to develop custom payloads. Organizations using this specific firmware version face immediate exposure to remote command execution.
What happens next
Business leaders should verify the firmware version on any Wavlink WL-WN530BE1-A routers in their network. If the devices are running version 251117, they are vulnerable to remote command injection. No official patch has been confirmed in the source material, so isolation or replacement may be necessary.
Background: Command injection
Command injection is a specific vulnerability type where an application passes untrusted input to a system shell. Remote code execution is the resulting capability to run arbitrary commands. You use command injection to achieve remote code execution on the target server.
Read the full guide: Difference Between RCE and Command Injection: Clear Definitions
What to do and how to stay safe: Wavlink
- Check the firmware version of all Wavlink WL-WN530BE1-A routers to ensure they are not running version 251117.
- Review network logs for unusual activity originating from or targeting the uploadVpn.cgi script.
- Restrict external access to the router's management interface to prevent remote exploitation attempts.
- Monitor vendor communications for updates or patches addressing CVE-2026-109108.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109108?
The vulnerability has a CVSS score of 9.4, which is rated as critical, though some records list it as 8.6 high.
Which Wavlink models are affected by this flaw?
Only the Wavlink WL-WN530BE1-A router running firmware version 251117 is affected by this vulnerability.
Is there a public exploit for this vulnerability?
Yes, the exploit has been disclosed publicly and may be used by attackers to exploit the command injection flaw.
