{"id":"CVE-2026-120198","kind":"vulnerability","aliases":["CVE-2026-120198"],"related":[],"title":"WAVLINK router: remote command injection via protocol.csp group_name","description":"A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WL-WN530BE1-A router firmware V251117 passes the group_name or IP-FROM argument in /protocol.csp to a command without proper checks. A remote attacker can inject operating system commands and run them on the device, and a public exploit exists.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WL-WN530BE1-A","fixed":[],"affected":"V251117","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","home-network","infrastructure","router","wavlink","wl-wn530be1-a"],"not_affected_if":["admin-interface-not-exposed","other-firmware-versions"],"how_to_check":"- Admin page: compare firmware to V251117 (M30BE1_V251117 in sibling advisories); that version is confirmed affected, other versions are not stated.\n- Check whether the web management interface (port 80/443) is reachable from the internet or untrusted networks; VulDB says no authentication is needed.\n- Also check any other WAVLINK models, since the sibling CVE-2026-113802 hit the same /protocol.csp handler.","fix":"unknown: no fixed firmware published in any source read; check WAVLINK's support page","status":"open","published_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","triaged_at":"2026-11-01T06:49:00+00:00","updated_at":"2026-11-01T06:49:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T06:49:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK router: remote command injection via protocol.csp group_name","impact":"high","summary":"The WAVLINK WL-WN530BE1-A router firmware V251117 passes the group_name or IP-FROM argument in /protocol.csp to a command without proper checks. A remote attacker can inject operating system commands and run them on the device, and a public exploit exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wl-wn530be1-a","router","firmware","home-network"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely.","analyst_note":"Confirm whether the vendor has released a fixed firmware version and whether authentication is needed to reach /protocol.csp; check the NVD entry and vendor advisory.","how_to_check":"- Check the firmware version on the device admin page against `V251117`\n- Check whether the web management interface is reachable from the internet\n- unknown for other checks","plain_action":"If you own a WAVLINK WL-WN530BE1-A router, check its firmware version and turn off remote access to its admin page until the vendor provides a fix.","needs_analyst":true,"not_affected_if":["other-firmware-versions","admin-interface-not-exposed"],"who_is_affected":"Owners of WAVLINK WL-WN530BE1-A routers running firmware V251117 are affected, through the web interface at /protocol.csp. Exposure is highest where the admin interface is reachable from the internet. Devices with the admin interface restricted to a trusted local network are less exposed, though the sources do not state this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4149,"output_tokens":629,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the vendor has released a fixed firmware version and whether authentication is needed to reach /protocol.csp; check the NVD entry and vendor advisory.","search":"'-120198':12A,15A '-2026':11A,14A '/protocol.csp':49B,98C 'a':19A 'affect':87C 'argument':47B,103C 'attack':58B,116C 'check':55B,92C 'command':4A,52B,63B,108C 'con':91C 'contact':133C 'cve':10A,13A 'devic':69B 'disclos':122C 'disclosur':137C 'earli':134C 'exist':74B 'exploit':73B,119C 'file':97C 'finish':94C 'firmwar':20B,37B 'found':79C 'function':90C 'group':8A,41B,104C 'home':22B 'home-network':21B 'infrastructur':24B 'inject':5A,60B,109C 'ip':45B 'ip-from':44B 'launch':114C 'lead':106C 'manipul':100C 'may':127C 'name':9A,42B 'name/ip-from':105C 'network':23B 'oper':61B 'pass':39B 'possibl':112C 'proper':54B 'protocol.csp':7A 'public':72B,125C 'read':93C 'remot':3A,57B,117C 'router':2A,25B,36B 'run':65B 'system':62B 'use':129C 'v251117':38B,86C 'vendor':131C 'via':6A 'vulner':76C 'wavlink':1A,26B,31B,81C 'without':53B 'wl':17A,28B,33B,83C 'wl-wn530be1-a':16A,27B,32B,82C 'wn530be1':18A,29B,34B,84C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WL-WN530BE1-A routers on firmware V251117 are affected. VulDB says the flaw is reachable remotely without authentication through /protocol.csp and a public proof of concept exists. Anyone whose admin interface is only reachable from a trusted local network is less exposed; other models and firmware versions are not stated to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WL-WN530BE1-A router, check its firmware version and turn off remote access to its admin page until the vendor provides a fix.","first_public_at":"2026-11-01T05:18:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120198","severity":null,"published_at":"2026-11-01T05:18:57+00:00","modified_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","fetched_at":"2026-11-01T06:48:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120198:1281","url":null,"severity":null,"published_at":"2026-11-01T06:49:35+00:00","modified_at":"2026-11-01T06:49:35+00:00","first_seen_at":"2026-11-01T06:49:35+00:00","fetched_at":"2026-11-01T06:49:35+00:00","note":"No vendor advisory found; VulDB (CNA) says remote, no authentication needed, PoC public on github (link hidden), no countermeasure known, vendor contacted early. No fixed firmware stated anywhere; fix unknown. Likely related to but distinct from CVE-2026-113802 (ovpn_file file_id, forged IP-FROM 127.0.0.1 auth bypass, same firmware): group_name/IP-FROM here may reuse that bypass, unconfirmed. Not exploited in the wild per sources."}],"documents":[{"id":37397,"url":"https://vuldb.com/vuln/429561","title":"VulDB VDB-429561: WAVLINK WL-WN530BE1-A protocol.csp command injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1881,"url":"https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler","title":"VulnCheck: sibling CVE-2026-113802, same product /protocol.csp","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}