Key points
- The flaw is CVE-2026-109108 with a CVSS score of 9.4.
- It affects Wavlink WL-WN530BE1-A devices running firmware version 251117.
- Public exploit code is available for this remote command injection issue.
Wavlink router firmware version 251117 contains a critical security flaw that allows remote attackers to inject operating system commands. The vulnerability, tracked as CVE-2026-109108, affects the WL-WN530BE1-A model. Researchers have disclosed the exploit publicly, meaning threat actors can use it to perform remote attacks against the device.
In plain English
The bug exists in a web script called uploadVpn.cgi located in the router’s cgi-bin directory. When this script processes the "Type" argument, it fails to sanitize user input before passing it to the system’s popen function. This allows an attacker to append malicious shell commands to the request. The router then executes these commands, leading to OS command injection as described in the vulnerability record.
The background
The Common Vulnerabilities and Exposures database rates this issue at 9.4, which falls into the critical severity range. The weakness is categorized under CWE-78 and CWE-77, which cover improper neutralization of special elements in OS commands and OS command injection, respectively. According to the NVD record, the vendor was contacted early regarding this disclosure. However, no patch or firmware update has been confirmed to address the vulnerability yet.
What changes now
Security teams must treat this as an urgent risk because the exploit is public and remote. Any Wavlink WL-WN530BE1-A device running the 251117 firmware build is vulnerable by default. Until the vendor releases a fix, these routers are at high risk of being targeted by attackers scanning for this specific CVE. Organizations should isolate affected devices from trusted networks immediately.
What to do and how to stay safe: Wavlink
- Inventory all Wavlink WL-WN530BE1-A routers and check if they are running firmware version 251117.
- Isolate vulnerable devices from the internet by placing them behind a strict firewall that blocks inbound traffic to the web interface.
- Monitor network logs for unusual outbound connections or unexpected command executions originating from the router’s IP address.
- Watch for official announcements from Wavlink regarding a firmware update that addresses CVE-2026-109108 once the vendor provides an update.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wavlink router model is affected by this vulnerability?
The Wavlink WL-WN530BE1-A model is affected, specifically those running firmware version 251117.
Is there a patch available for CVE-2026-109108?
No fix has been confirmed yet, although the vendor was contacted early about the disclosure.
How severe is this vulnerability rated?
It is rated Critical with a CVSS score of 9.4 by the NVD.
