{"id":"CVE-2026-113802","published":"2026-10-20T18:17:21.430","lastModified":"2026-10-21T16:17:28.990","description":"Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN530BE1(en).md","tags":[]},{"url":"https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler","tags":[]}],"exploitRefs":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN530BE1(en).md","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows remote attackers to execute arbitrary commands as root on Wavlink routers by injecting OS commands through an unsanitized parameter in the firmware's web interface. The flaw stems from improper input validation in the ioos binary, making it a critical command injection vulnerability.","exploitability":"Exploitation is straightforward for remote unauthenticated attackers who can send forged IP-FROM headers to bypass authentication and execute commands with root privileges.","blast_radius":"The vulnerability affects multiple Wavlink routers running firmware version M30BE1_V251117 or earlier, potentially allowing widespread remote code execution across affected devices in the field.","remediation":"Upgrade to firmware version M30BE1_V251118 or later to remediate this command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","web","router"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:23:39.800Z"}}