CVE-2026-113802Critical· 9.8▾ MidnightWavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests wit…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
WL-WN530BE1-A M30BE1_V251117Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109108Critical· 9.9A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117
CVE-2026-8230Medium· 6.3A flaw has been found in Wavlink NU516U1 240425
CVE-2026-8229Medium· 6.3A vulnerability was detected in Wavlink NU516U1 240425
CVE-2026-110957Critical· 10.0A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604
CVE-2026-109110Critical· 10.0A flaw has been found in Wavlink WL-WN592AX6 250422
CVE-2026-109109Critical· 10.0A vulnerability was detected in Wavlink WL-WN530BE1-A 251117