---
id: "CVE-2026-113802"
kind: "vulnerability"
aliases: ["CVE-2026-113802"]
title: "Wavlink router firmware: unauthenticated remote command execution as root"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WL-WN530BE1-A firmware", "fixed": [], "affected": "<= M30BE1_V251117", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "infrastructure", "iot", "routers", "self-hosted", "wavlink", "wl-wn530be1-a"]
not_affected_if: ["admin-not-exposed", "default-config", "different-model"]
published_at: "2026-10-20T18:17:21+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:19:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113802", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:19:13+00:00"}]
---

# Wavlink router firmware: unauthenticated remote command execution as root

Wavlink WL-WN530BE1-A firmware M30BE1_V251117 and earlier: the ioos web daemon treats a client-supplied 'IP-FROM: 127.0.0.1' header as a local request and skips login. The file_id parameter of /protocol.csp?opt=ovpn_file&type=del then goes unsanitized into snprintf/popen, giving unauthenticated root command execution. A public PoC exists. No vendor fix has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WL-WN530BE1-A firmware affected <= M30BE1_V251117 fixed ?

## How to check

Check the model (WL-WN530BE1-A) and the firmware version in the admin UI. M30BE1_V251117 or older is affected. Check whether the admin web interface is reachable from WAN or untrusted networks (remote management, port forwards, or a scan of the public IP on port 80/443). To test your own device only: GET /protocol.csp?opt=ovpn_file&function=set&type=del&file_id=... with header IP-FROM: 127.0.0.1 (see the PoC; a harmless payload is touch of a file).

## Fix

No fixed firmware found as of 2026-10-23; the affected range is 'through M30BE1_V251117' and the vendor has not published an advisory. Mitigation: disable WAN/remote management, restrict the admin interface to a trusted LAN segment, and block or strip the IP-FROM request header at any reverse proxy in front of it. Watch docs.wavlink.xyz/Firmware for a newer M30BE1 build, or replace the device.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113802
- 2026-10-23T23:19:13+00:00 analyst — Read VulnCheck CNA advisory and researcher F-yyjy's PoC writeup (public, request included). No vendor advisory or fixed firmware found (Wavlink docs firmware page empty); not in KEV; CISA-ADP says exploitation=poc, automatable=yes; no in-the-wild report found. Root cause: ioos trusts client-supplied IP-FROM header as the source address, so login is skipped, then file_id goes to snprintf+popen. Sibling Wavlink CVEs on the same model (e.g. CVE-2026-109109) exist.

## Documents

- [advisory] VulnCheck advisory CVE-2026-113802 https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler
- [mentions] Vulnerability-Lookup: CISA-ADP exploitation=poc, automatable=yes https://cve.circl.lu/search?vendor=wavlink
- [poc] F-yyjy: WAVLINK WN530BE1-A Unauthenticated Command Injection https://github.com/F-yyjy/cve/blob/main/WN530BE1(en).md

## From the sources

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_