Wavlink WL-WN530BE1-A: OS command injection via /protocol.csp (CVE-2026-113802)

Wavlink WL-WN530BE1-A firmware versions up to and including M30BE1_V251117 contain a critical OS command injection vulnerability, identified as CVE-2026-113802. The vulnerability exists within the sub_23B54 function of the ioos binary. This function improperly processes the file_id parameter when handling requests to the /protocol.csp endpoint with the option opt=ovpn_file and type=del. Because the input is passed directly to the popen() function without adequate sanitization, an attacker can supply shell metacharacters to execute arbitrary code. Furthermore, an attacker can bypass authentication requirements by forging the IP-FROM header to 127.0.0.1. Successfully exploiting this vulnerability allows an unauthenticated remote attacker to execute commands with root privileges on the affected networking device.

Impact

Successful exploitation of CVE-2026-113802 grants an attacker full root-level control over the target Wavlink router. This impact includes the potential for full network traffic interception, modification of device configurations, persistent backdooring of the device firmware, and the ability to use the device as a pivot point for further lateral movement within the local area network.

Recommendation

• Monitor for unauthorized HTTP requests to the /protocol.csp endpoint that include the opt=ovpn_file parameter.
• Implement network segmentation to isolate vulnerable networking hardware from sensitive segments of the internal network.
• Check for and apply firmware updates from Wavlink that remediate CVE-2026-113802.
• Use the provided Sigma rule to detect exploitation attempts targeting the identified vulnerable endpoint parameters.