What’s Vulnerable › Vulnerabilities

CVE-2026-120198: WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• Public exploit or detection template: none known
• Published: 2026-11-01 · updated 2026-11-01
• Weakness: CWE-74

Description

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Summary

A critical command injection flaw (CVE-2026-120198, CVSS 10) exists in WAVLINK WL-WN530BE1-A V251117, in the con_check_read_finish function of /protocol.csp, where manipulation of the group_name/IP-FROM argument allows remote command execution. The exploit has been publicly disclosed and may be used, though it is not in CISA KEV. Users of this device and firmware version are affected. Apply the vendor's fix when available and, until then, restrict remote access to the device's management interface.

توجد ثغرة حقن أوامر حرجة (CVE-2026-120198، بدرجة CVSS 10) في WAVLINK WL-WN530BE1-A V251117، ضمن الدالة con_check_read_finish في الملف /protocol.csp، حيث يتيح التلاعب بالوسيط group_name/IP-FROM تنفيذ أوامر عن بُعد. تم الكشف عن الاستغلال للعموم وقد يُستخدم، رغم أنه ليس مدرجًا في CISA KEV. المتأثرون هم مستخدمو هذا الجهاز وإصدار البرنامج الثابت المذكور. طبّق إصلاح الشركة عند توفره، وإلى حين ذلك قيّد الوصول البعيد إلى واجهة إدارة الجهاز.

Affected products

• Wavlink WL-WN530BE1-A: V251117

References

• https://github.com/pipiyyb/cve/blob/main/WN530BE1.md
• https://vuldb.com/cve/CVE-2026-120198
• https://vuldb.com/submit/918551
• https://vuldb.com/vuln/429561
• https://vuldb.com/vuln/429561/cti

Get alerted when CVE-2026-120198 or the next vulnerability affects your stack