WL-WN530BE2-a (< 2026-09-24-841a51c6d5_tclinux.bin) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wl-wn530be2-a--2026-09-24-841a51c6d5_tclinux.bin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 16:39:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Command Injection in Wavlink WL-WN530BE2-Ahttps://feed.craftedsignal.io/briefs/2026-10-wavlink-rce/Thu, 15 Oct 2026 16:39:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wavlink-rce/An unauthenticated remote code execution vulnerability (CVE-2026-110957) in the Wavlink WL-WN530BE2-A router allows attackers to inject OS commands via the REMOTE_ADDR parameter in api.cgi.CVE-2026-110957 is a critical vulnerability affecting Wavlink WL-WN530BE2-A devices running firmware up to version M30BE2_V250604. The vulnerability exists within the login processing component of the device, specifically in the api.cgi handler. Attackers can leverage improper input validation of the REMOTE_ADDR argument to achieve unauthenticated remote command injection. Because the application historically used the system() function to process login requests, an attacker can supply malicious input that is executed with elevated privileges on the underlying operating system. This vulnerability has been publicly disclosed and is considered exploitable in the wild. Wavlink has released a patch in firmware version 2026-09-24-841a51c6d5_tclinux.bin, which mitigates the issue by replacing the shell-based invocation with a secure argument vector (execvp) and implementing strict input length constraints.

Impact

The vulnerability carries a CVSS v3.1 base score of 10.0, representing the maximum severity level. Successful exploitation permits an unauthenticated remote attacker to execute arbitrary commands on the router hardware. This can lead to full device compromise, potential participation in botnets, interception of network traffic, and a permanent entry point into the internal network for further lateral movement. Organizations using these devices as perimeter gateways or VPN concentrators are at elevated risk.

Recommendation

  • Immediately upgrade all Wavlink WL-WN530BE2-A routers to firmware version 2026-09-24-841a51c6d5_tclinux.bin or later to address CVE-2026-110957.
  • Identify and isolate all internet-facing Wavlink WL-WN530BE2-A devices until firmware updates can be applied.
  • Monitor webserver access logs for anomalous HTTP POST requests to api.cgi, specifically looking for shell metacharacters within the REMOTE_ADDR header or query parameters.
]]>criticaladvisoryvulnerabilityrcenetwork-securitycve-2026-110957