---
id: CVE-2026-109109
title: A vulnerability was detected in Wavlink WL-WN530BE1-A 251117
summary: >-
  A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This
  vulnerability affects the function strcpy of the file
  /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI.
  Performing a manipulation of the argument HTTP_…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-121
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T08:17:00.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109109'
references:
  - url: 'https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-109109'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/909191'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416860'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416860/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-13T08:19:03.892Z'
---

## Overview

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.