External risk intelligence

Wavlink WL-WN5302BE-A OS Command Injection in Login Processing

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110957

The vulnerability affects a Wavlink wireless router/access point. These devices are internet-facing network infrastructure by design. The flaw exists in the login processing component, which is a public-facing interface commonly exposed to the internet for remote management or as a gateway, making it highly likely to be reachable in standard deployments.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote command injection vulnerability has been publicly disclosed in Wavlink wireless routers. This flaw allows an attacker to execute arbitrary commands on the device, potentially compromising its security and network. The vendor has confirmed this issue and released a firmware update to address it, emphasizing that the affected function no longer builds commands in an unsafe manner.

Command injection flaw in router login processing.
Remote exploitation is publicly disclosed and likely.
Confirm device relevance and apply firmware updates.

Attack Path

How an attacker could exploit the issue

An attacker can remotely exploit this vulnerability by sending a specially crafted request to the device. This request targets the login processing component, specifically the `api.cgi` file. By manipulating the `REMOTE_ADDR` argument, an attacker can inject operating system commands, potentially leading to significant compromise.

No authentication required for attack.
Triggered by manipulating a login argument.
Leads to unauthorized command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on the affected device by manipulating the REMOTE_ADDR argument in the api.cgi script. This could impact the device's core functionality and potentially grant unauthorized access to its network.

Device's command execution
Remote command injection via crafted request
Compromise of device and network access

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Wavlink WL-WN530BE2-A likely impacts infrastructure or network teams responsible for managing edge devices. The first practical step is to identify all instances of this device, confirm their internet reachability and business criticality, and then engage the responsible owner to plan for remediation.

Infrastructure and network teams own the issue.
Verify device exposure and business criticality.
Plan for firmware upgrade to address the vulnerability.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wavlink WL-WN530BE2-A?

The Wavlink WL-WN530BE2-A is a wireless router or access point designed to manage network traffic. These devices serve as foundational infrastructure, often acting as gateways that bridge local devices to the internet. Because they operate at the edge of a network, they are frequently responsible for handling initial connection requests and user authentication processes.

How does CVE-2026-110957 enable command injection?

This vulnerability involves a weakness classified as OS Command Injection. It occurs when a program incorrectly handles user-provided data, allowing it to be interpreted as part of a system command. In this specific case, the login processing component fails to properly filter the input, enabling an attacker to append their own malicious instructions that the router then executes with system-level privileges.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not a precondition for this flaw. The attack is triggered by sending a specially crafted network request to the api.cgi file. Because the vulnerability exists within the login processing logic itself, the system attempts to process the malicious input before verifying the identity of the user, making it accessible to anyone who can reach the device over the network.

Is my device at risk if it faces the internet?

Halo Surface Signal indicates that routers like the Wavlink WL-WN530BE2-A are often intentionally internet-facing to support remote management or gateway functions. If your device is configured to be reachable from the public internet, the risk is significantly higher, as an attacker does not need local network access to send the request that triggers this command injection.

What is the first step to address this CVE?

The most effective way to remediate this issue is to apply the official firmware update provided by the vendor. Start by identifying all instances of the affected router model within your network, verifying their current configuration, and upgrading to the version that replaces unsafe command handling methods with secure execution practices.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.