{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wl-wn530be1-a--m30be1_v251117/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:wavlink:wl-wn530be1-a_firmware:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-113802"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WL-WN530BE1-A (\u003c= M30BE1_V251117)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Wavlink"],"content_html":"\u003cp\u003eWavlink WL-WN530BE1-A firmware versions up to and including M30BE1_V251117 contain a critical OS command injection vulnerability, identified as CVE-2026-113802. The vulnerability exists within the sub_23B54 function of the ioos binary. This function improperly processes the file_id parameter when handling requests to the /protocol.csp endpoint with the option opt=ovpn_file and type=del. Because the input is passed directly to the popen() function without adequate sanitization, an attacker can supply shell metacharacters to execute arbitrary code. Furthermore, an attacker can bypass authentication requirements by forging the IP-FROM header to 127.0.0.1. Successfully exploiting this vulnerability allows an unauthenticated remote attacker to execute commands with root privileges on the affected networking device.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-113802 grants an attacker full root-level control over the target Wavlink router. This impact includes the potential for full network traffic interception, modification of device configurations, persistent backdooring of the device firmware, and the ability to use the device as a pivot point for further lateral movement within the local area network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor for unauthorized HTTP requests to the /protocol.csp endpoint that include the opt=ovpn_file parameter.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to isolate vulnerable networking hardware from sensitive segments of the internal network.\u003c/li\u003e\n\u003cli\u003eCheck for and apply firmware updates from Wavlink that remediate CVE-2026-113802.\u003c/li\u003e\n\u003cli\u003eUse the provided Sigma rule to detect exploitation attempts targeting the identified vulnerable endpoint parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T19:45:07Z","date_published":"2026-10-20T19:45:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wavlink-command-injection/","summary":"Wavlink WL-WN530BE1-A firmware through version M30BE1_V251117 is vulnerable to unauthenticated remote code execution via an OS command injection flaw in the /protocol.csp endpoint.","title":"Wavlink WL-WN530BE1-A: OS command injection via /protocol.csp (CVE-2026-113802)","url":"https://feed.craftedsignal.io/briefs/2026-10-wavlink-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - WL-WN530BE1-a (\u003c= M30BE1_V251117)","version":"https://jsonfeed.org/version/1.1"}