CVE-2026-120198

WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

CRITICAL 10.0

CVSS 4.0Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PPublished: 2026-11-01 04:15 UTCUpdated: 2026-11-02 14:20 UTCAssigner: VulDB

Description

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CWE

Affected

WAVLINK WL-WN530BE1-A

References

https://vuldb.com/vuln/429561vdb-entry, technical-description
https://vuldb.com/vuln/429561/ctisignature, permissions-required
https://vuldb.com/cve/CVE-2026-120198third-party-advisory
https://vuldb.com/submit/918551third-party-advisory
https://github.com/pipiyyb/cve/blob/main/WN530BE1.mdexploit

View on CVE.org