{"id":"CVE-2026-113802","kind":"vulnerability","aliases":["CVE-2026-113802"],"related":[],"title":"Wavlink router firmware: unauthenticated remote command execution as root","description":"Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.","summary":"Wavlink WL-WN530BE1-A firmware M30BE1_V251117 and earlier: the ioos web daemon treats a client-supplied 'IP-FROM: 127.0.0.1' header as a local request and skips login. The file_id parameter of /protocol.csp?opt=ovpn_file&type=del then goes unsanitized into snprintf/popen, giving unauthenticated root command execution. A public PoC exists. No vendor fix has been published.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WL-WN530BE1-A firmware","fixed":[],"affected":"<= M30BE1_V251117","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","infrastructure","iot","routers","self-hosted","wavlink","wl-wn530be1-a"],"not_affected_if":["admin-not-exposed","default-config","different-model"],"how_to_check":"Check the model (WL-WN530BE1-A) and the firmware version in the admin UI. M30BE1_V251117 or older is affected. Check whether the admin web interface is reachable from WAN or untrusted networks (remote management, port forwards, or a scan of the public IP on port 80/443). To test your own device only: GET /protocol.csp?opt=ovpn_file&function=set&type=del&file_id=... with header IP-FROM: 127.0.0.1 (see the PoC; a harmless payload is touch of a file).","fix":"No fixed firmware found as of 2026-10-23; the affected range is 'through M30BE1_V251117' and the vendor has not published an advisory. Mitigation: disable WAN/remote management, restrict the admin interface to a trusted LAN segment, and block or strip the IP-FROM request header at any reverse proxy in front of it. Watch docs.wavlink.xyz/Firmware for a newer M30BE1 build, or replace the device.","status":"open","published_at":"2026-10-20T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:22+00:00","updated_at":"2026-10-23T23:19:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Wavlink router firmware: unauthenticated remote command execution as root","impact":"high","summary":"Wavlink WL-WN530BE1-A routers running firmware through M30BE1_V251117 pass the file_id parameter of an OpenVPN file-delete request straight into a shell call. A remote attacker who forges an IP-FROM: 127.0.0.1 header skips login and runs arbitrary commands as root.","category":"infrastructure","who_cares":["wavlink","routers","self-hosted","wl-wn530be1-a"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs commands as root on the router and takes full control","analyst_note":"Check the vendor or NVD page for a fixed firmware version and whether the web admin interface is exposed on WAN; sources gave neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":3006,"output_tokens":371,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor or NVD page for a fixed firmware version and whether the web admin interface is exposed on WAN; sources gave neither.","search":"'-113802':12A,15A '-2026':11A,14A '/protocol.csp':70B,128C '127.0.0.1':56B,149C '23b54':114C 'a':19A 'arbitrari':156C 'attack':141C 'binari':119C 'bypass':152C 'client':51B 'client-suppli':50B 'command':6A,22B,84B,108C,157C 'command-inject':21B 'contain':105C 'cve':10A,13A 'daemon':47B 'del':75B,135C 'earlier':43B 'execut':7A,85B,155C 'exist':89B 'file':66B,73B,124C,131C 'firmwar':3A,39B,101C 'firmware':20A 'fix':92B 'forg':145C 'function':115C 'give':81B 'goe':77B 'header':57B,150C 'host':29B 'id':67B,125C 'infrastructur':24B 'inject':23B,109C 'ioo':45B,118C 'iot':25B 'ip':54B,147C 'ip-from':53B,146C 'local':60B 'login':64B,153C 'm30be1':40B,103C 'opt':71B,129C 'os':107C 'ovpn':72B,130C 'paramet':68B,126C 'pass':121C 'poc':88B 'popen':137C 'public':87B 'publish':95B 'remot':5A,139C 'request':61B,132C 'root':9A,83B,159C 'router':2A,26B 'self':28B 'self-host':27B 'send':143C 'skip':63B 'snprintf/popen':80B 'sub':113C 'suppli':52B 'treat':48B 'type':74B,134C 'unauthent':4A,82B,140C 'unsanit':78B,123C 'v251117':41B,104C 'vendor':91B 'vulner':110C 'wavlink':1A,30B,34B,96C 'web':46B 'wl':17A,32B,36B,98C 'wl-wn530be1-a':16A,31B,35B,97C 'wn530be1':18A,33B,37B,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-113802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113802","severity":null,"published_at":"2026-10-20T18:17:21+00:00","modified_at":"2026-10-21T16:17:28+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113802:414","url":null,"severity":null,"published_at":"2026-10-23T23:19:13+00:00","modified_at":"2026-10-23T23:19:13+00:00","first_seen_at":"2026-10-23T23:19:13+00:00","fetched_at":"2026-10-23T23:19:13+00:00","note":"Read VulnCheck CNA advisory and researcher F-yyjy's PoC writeup (public, request included). No vendor advisory or fixed firmware found (Wavlink docs firmware page empty); not in KEV; CISA-ADP says exploitation=poc, automatable=yes; no in-the-wild report found. Root cause: ioos trusts client-supplied IP-FROM header as the source address, so login is skipped, then file_id goes to snprintf+popen. Sibling Wavlink CVEs on the same model (e.g. CVE-2026-109109) exist."}],"documents":[{"id":1881,"url":"https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler","title":"VulnCheck advisory CVE-2026-113802","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1883,"url":"https://github.com/F-yyjy/cve/blob/main/WN530BE1(en).md","title":"F-yyjy: WAVLINK WN530BE1-A Unauthenticated Command Injection","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1884,"url":"https://cve.circl.lu/search?vendor=wavlink","title":"Vulnerability-Lookup: CISA-ADP exploitation=poc, automatable=yes","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}