Key points
- Wavlink WL-WN530BE1-A firmware through version M30BE1_V251117 is affected.
- The flaw allows remote, unauthenticated command execution as root.
- No vendor fix or update status has been confirmed.
Wavlink WL-WN530BE1-A wireless routers running firmware version M30BE1_V251117 or earlier contain a critical security flaw. National Vulnerability Database records identify this issue as CVE-2026-113802. The vulnerability allows attackers to execute arbitrary commands on the device with root privileges. This means an attacker gains full control of the router without needing a password.
In plain English
The flaw exists in the ioos binary within the router’s firmware. Specifically, the sub_23B54 function fails to sanitize user input. When a request is made to /protocol.csp?opt=ovpn_file with type=del, the file_id parameter is passed directly to a system command. Attackers can manipulate this parameter to inject their own commands.
The background
An attacker does not need to log in to exploit this weakness. By sending a forged IP-FROM header set to 127.0.0.1, they can bypass authentication checks. This trick makes the router believe the request comes from its own local interface. The injected commands then run with the highest system privileges.
What changes now
The source material does not state whether a patch or firmware update exists. Small-business owners using this specific Wavlink model remain exposed to remote takeover risks. The flaw is rated 9.3 on the CVSS scale, which indicates critical severity. Users must rely on network-level protections until a fix status is clarified.
Who needs to act first
Teams usually prioritize systems that face the internet directly. Check whether your Wavlink router is accessible from outside your local network. If it is, isolate it immediately by blocking external access at your firewall. Back up your current configuration before making changes. Test any network restrictions on a non-critical device first to ensure business continuity is not disrupted while you wait for a vendor update.
What to do and how to stay safe: Wavlink
- Block external access to the router's management interface using your upstream firewall.
- Verify that the device firmware version is M30BE1_V251117 or earlier.
- Monitor network logs for unusual outbound traffic from the router.
- Disconnect the device from the network if you cannot restrict access.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Wavlink models are affected?
Only the Wavlink WL-WN530BE1-A model running firmware through version M30BE1_V251117 is affected.
Can an attacker exploit this without a password?
Yes, the vulnerability allows unauthenticated remote command execution as root.
Is there a patch available for CVE-2026-113802?
The source material does not confirm if a fix exists.
