Key points
- CVE-2026-109108 carries a CVSS score of 9.4, classified as critical severity.
- The vulnerability resides in the uploadVpn.cgi file within the affected firmware.
- Public exploit code is available, and the vendor was contacted early.
The short version
- Wavlink WL-WN530BE1-A firmware 251117 contains a critical remote command injection flaw.
- Attackers can manipulate the Type argument in uploadVpn.cgi to execute OS commands.
- The exploit details have been disclosed publicly and may be used.
The details
Wavlink WL-WN530BE1-A devices running firmware version 251117 are affected by a critical security flaw identified as CVE-2026-109108. According to the National Vulnerability Database record, this issue allows for remote command injection. The vulnerability stems from improper input handling within the popen function located in the /cgi-bin/uploadVpn.cgi file. Attackers can manipulate the Type argument passed to this script to execute arbitrary operating system commands on the device.
The flaw is rated with a CVSS score of 9.4, placing it in the critical severity range. The underlying weaknesses are classified as CWE-78 and CWE-77, indicating improper neutralization of special elements in OS commands. Because the attack vector is remote, an adversary does not need local access or authentication to exploit the device. The NVD record states that the exploit has been disclosed publicly and may be used by threat actors.
The context
The vendor was contacted early regarding this disclosure, according to the NVD entry. The source material does not state whether a patch or firmware update is available. The public nature of the exploit means that the details are accessible. That suggests users of this specific firmware version are at risk if their devices are exposed to the internet.
What should you do?
Users running Wavlink WL-WN530BE1-A firmware 251117 should assume their devices are vulnerable. Check the current firmware version in the device administration interface. If the version matches 251117, isolate the device from the internet until a fix is released. Monitor Wavlink’s support pages for an official security update. Disable remote management features if they are not strictly necessary for your operations.
What to do and how to stay safe: Wavlink
- Verify the firmware version of all Wavlink WL-WN530BE1-A devices in your environment.
- Isolate affected devices from untrusted networks to prevent remote exploitation.
- Monitor vendor communications for an official patch addressing CVE-2026-109108.
- Review network logs for unusual outbound traffic from affected devices.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109108?
The CVSS score is 9.4, which is classified as critical severity.
Which firmware version is affected by this vulnerability?
Wavlink WL-WN530BE1-A firmware version 251117 is affected.
Was the vendor contacted about this issue?
Yes, the vendor was contacted early about this disclosure.
