---
id: "CVE-2026-120198"
kind: "vulnerability"
aliases: ["CVE-2026-120198"]
title: "WAVLINK router: remote command injection via protocol.csp group_name"
severity: "critical"
cvss: 10.0
epss: 0.0207
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WL-WN530BE1-A", "fixed": [], "affected": "V251117", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["firmware", "home-network", "infrastructure", "router", "wavlink", "wl-wn530be1-a"]
not_affected_if: ["admin-interface-not-exposed", "other-firmware-versions"]
published_at: "2026-11-01T05:18:57+00:00"
first_seen_at: "2026-11-01T06:48:24+00:00"
updated_at: "2026-11-01T16:46:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120198", "first_seen_at": "2026-11-01T06:48:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T06:49:35+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-120198", "first_seen_at": "2026-11-01T16:46:41+00:00"}]
---

# WAVLINK router: remote command injection via protocol.csp group_name

The WAVLINK WL-WN530BE1-A router firmware V251117 passes the group_name or IP-FROM argument in /protocol.csp to a command without proper checks. A remote attacker can inject operating system commands and run them on the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WL-WN530BE1-A affected V251117 fixed ?

## How to check

- Admin page: compare firmware to V251117 (M30BE1_V251117 in sibling advisories); that version is confirmed affected, other versions are not stated.
- Check whether the web management interface (port 80/443) is reachable from the internet or untrusted networks; VulDB says no authentication is needed.
- Also check any other WAVLINK models, since the sibling CVE-2026-113802 hit the same /protocol.csp handler.

## Fix

unknown: no fixed firmware published in any source read; check WAVLINK's support page

## Timeline

- 2026-11-01T06:48:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120198
- 2026-11-01T06:49:35+00:00 analyst — No vendor advisory found; VulDB (CNA) says remote, no authentication needed, PoC public on github (link hidden), no countermeasure known, vendor contacted early. No fixed firmware stated anywhere; fix unknown. Likely related to but distinct from CVE-2026-113802 (ovpn_file file_id, forged IP-FROM 127.0.0.1 auth bypass, same firmware): group_name/IP-FROM here may reuse that bypass, unconfirmed. Not exploited in the wild per sources.
- 2026-11-01T16:46:41+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-120198

## Documents

- [describes] VulDB VDB-429561: WAVLINK WL-WN530BE1-A protocol.csp command injection https://vuldb.com/vuln/429561
- [mentions] VulnCheck: Wavlink WN530BE1-A unauthenticated command injection, same file_id/ovpn_file handler (different model) https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler

## From the sources

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_