How do I check whether I am affected by CVE-2026-113802?

Check the model (WL-WN530BE1-A) and the firmware version in the admin UI. M30BE1_V251117 or older is affected. Check whether the admin web interface is reachable from WAN or untrusted networks (remote management, port forwards, or a scan of the public IP on port 80/443). To test your own device only: GET /protocol.csp?opt=ovpn_file&function=set&type=del&file_id=... with header IP-FROM: 127.0.0.1 (see the PoC; a harmless payload is touch of a file).

What is the fix for CVE-2026-113802?

No fixed firmware found as of 2026-10-23; the affected range is 'through M30BE1_V251117' and the vendor has not published an advisory. Mitigation: disable WAN/remote management, restrict the admin interface to a trusted LAN segment, and block or strip the IP-FROM request header at any reverse proxy in front of it. Watch docs.wavlink.xyz/Firmware for a newer M30BE1 build, or replace the device.

Who is not affected by CVE-2026-113802?

Not affected if: admin-not-exposed, default-config, different-model.

Live › vulnerability › CVE-2026-113802

Go to dashboard

critical9.8Infrastructure

Wavlink router firmware: unauthenticated remote command execution as root

Wavlink WL-WN530BE1-A firmware M30BE1_V251117 and earlier: the ioos web daemon treats a client-supplied 'IP-FROM: 127.0.0.1' header as a local request and skips login. The file_id parameter of /protocol.csp?opt=ovpn_file&type=del then goes unsanitized into snprintf/popen, giving unauthenticated root command execution. A public PoC exists. No vendor fix has been published.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs commands as root on the router and takes full control.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-113802

Go to dashboard

critical9.8Infrastructure

Wavlink router firmware: unauthenticated remote command execution as root

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs commands as root on the router and takes full control.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Wavlink router firmware: unauthenticated remote command execution as root

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Wavlink router firmware: unauthenticated remote command execution as root

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources