OS Command Injection in Wavlink WL-WN530BE1-A Router
CVE-2026-109108

9.4CRITICAL

Key Information:

Vendor

Wavlink

Status
Wl-wn530be1-a
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109108?

A security vulnerability exists in the Wavlink WL-WN530BE1-A router, specifically affecting the popen function in the /cgi-bin/uploadVpn.cgi file. This issue arises from improper handling of the 'Type' parameter, which allows remote attackers to execute arbitrary OS commands. The exploit has been made public, escalating the risk of potential attacks. Prompt action and patching are advised to secure the affected router against unauthorized access.

Affected Version(s)

WL-WN530BE1-A 251117

References

https://vuldb.com/vuln/416859
vdb-entrytechnical-description
https://vuldb.com/vuln/416859/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109108
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tarbely (VulDB User)
VulDB CNA Team
.