External risk intelligence

Wavlink WL-WN530BE1-A Firmware Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-113802

The vulnerability affects a network device (router/access point) and is reachable via a web interface endpoint (/protocol.csp) that does not require authentication. Since such devices are commonly deployed at the edge of networks and managed via web interfaces, this surface is intentionally public-facing and accessible.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Wavlink firmware allows unauthenticated attackers to execute arbitrary commands as root by sending a forged header to a specific device function. The issue stems from the passing of an unsanitized parameter in a request that can be exploited to inject operating system commands.

Unauthenticated attackers can gain root access.
Such devices are often at the network edge.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target this vulnerability without needing any credentials by sending a specially crafted request to the device's web interface. This request exploits a flaw in how the firmware handles file deletion requests, specifically when processing the `file_id` parameter. By manipulating this parameter, an attacker can trick the `ioos` binary into executing arbitrary commands on the device with root privileges.

Entry Condition: Network access to the device's web interface.
Trigger Point: Sending a forged `IP-FROM` header in a request.
Resulting Risk: Arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device. The attacker could potentially gain root-level access by sending a specially crafted request to a specific endpoint, bypassing login mechanisms.

Device command execution.
Exploiting unsanitized input.
Compromise of device integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Wavlink firmware impacts network devices accessible via a web interface. Ownership likely falls to the infrastructure or network security teams responsible for managing these devices. The first practical step is to identify all deployed Wavlink WL-WN530BE1-A units, determine their network exposure, and confirm which are business-critical. Subsequently, plan remediation, which may involve vendor coordination or firmware updates.

Infrastructure or Network Security teams own this.
Verify external reachability and business criticality.
Plan remediation or coordinate with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wavlink WL-WN530BE1-A?

The Wavlink WL-WN530BE1-A is a networking device, such as a router or wireless access point, used to manage and extend network connectivity. It runs specialized firmware to handle device operations and features a web-based interface that allows administrators to configure network settings, manage files, and oversee system functions remotely.

What does OS command injection mean for CVE-2026-113802?

This vulnerability, classified as CWE-78, occurs when the device firmware fails to properly clean user-provided input before using it in a system command. In this case, the ioos binary processes file deletion requests insecurely, allowing an attacker to insert and execute their own unauthorized commands on the underlying operating system with root-level privileges.

How is this CVE-2026-113802 vulnerability triggered?

An attacker triggers this bug by sending a specifically crafted request to the device's web interface, targeting the ovpn_file handler. By including a forged IP-FROM: 127.0.0.1 header, they bypass standard login protections. The vulnerability is not triggered by normal administrative actions but specifically requires this manipulated request and header combination to force the system to execute the injected code.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this device is very likely at risk because it is a network-edge component with a web interface reachable from the internet. Because the vulnerability requires no authentication and exists on a device typically placed at the perimeter of a network, any unit accessible from outside your local network is considered exposed.

How should I respond to this Wavlink firmware vulnerability?

First, inventory your environment to locate all active Wavlink WL-WN530BE1-A devices. Prioritize identifying which units have their management web interfaces exposed to the internet. Once located, evaluate the business criticality of these devices and coordinate with the vendor or your infrastructure team to apply available firmware updates or restrict network access to the web interface.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.