{"id":"CVE-2026-109109","published":"2026-10-13T08:17:00.110","lastModified":"2026-10-14T14:17:36.663","description":"A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-109109","tags":[]},{"url":"https://vuldb.com/submit/909191","tags":[]},{"url":"https://vuldb.com/vuln/416860","tags":[]},{"url":"https://vuldb.com/vuln/416860/cti","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow vulnerability exists in the Wavlink WL-WN530BE1-A router's Settings Export CGI component, allowing remote attackers to execute arbitrary code through a manipulated HTTP_COOKIE or X-Cmd parameter. This critical flaw can lead to complete system compromise.","exploitability":"The exploit is highly practical with no special preconditions required, as it allows remote code execution through standard HTTP headers with a public exploit already available.","blast_radius":"The vulnerability affects all Wavlink routers with the specific model and firmware version, potentially enabling widespread remote system compromise across affected deployments.","remediation":"Upgrade to firmware version 2.590 or later immediately, as this is the first fixed version identified in the vendor's advisory for the affected device model.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","router","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:30.326Z"}}