External risk intelligence

Wavelog Configuration File Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-54237

Wavelog is web-based software designed for amateur radio logging. Such applications are frequently deployed as web services accessible over the internet to allow remote logging and data management, and the vulnerability exists within the application's web-accessible installation and interface components.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Wavelog, web-based amateur radio logging software, impacting versions prior to 2.4.2. The flaw allows unauthenticated attackers to execute code on the server by manipulating configuration files. The main concern is confirming relevance and exposure given the nature of the affected software.

Unauthenticated attackers can run code on servers.
Crucial for systems managing sensitive radio logs.
Confirm if this amateur radio software is deployed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit Wavelog's web interface to execute arbitrary code on the server. After installation, Wavelog fails to properly secure its `/install/ajax.php` and `/install/includes/interface_assets/triggers.php` files. By sending unsanitized data to these files, an unauthenticated attacker can manipulate configuration files, allowing them to run malicious code on the server.

No authentication needed to access.
Triggered by sending unsanitized input.
Allows arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

When installed, Wavelog could allow an unauthenticated remote attacker to read or write log files and inject malicious content into PHP configuration files. This could lead to the execution of arbitrary code on the server, when the affected configuration files are processed.

Server configuration files.
Attacker injects malicious content.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams responsible for Wavelog deployments should prioritize understanding the exposure of this web-based logging software. Given its potential for remote, unauthenticated attacks leading to code execution, the immediate focus should be on identifying all instances, assessing their internet-facing status and business criticality, and locating the accountable owner for remediation planning.

Application owners should investigate Wavelog instances.
Verify internet accessibility and business criticality first.
Plan remediation or mitigation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wavelog and how is it used?

Wavelog is a web-based software application specifically designed for amateur radio enthusiasts to track and log their radio contacts. Because it runs on a web server, it enables users to manage their logging data remotely through a browser interface, often by hosting the service on their own network infrastructure.

How does CVE-2026-54237 create a security weakness?

This vulnerability involves Improper Neutralization of Special Elements used in an OS Command and Missing Authorization. In plain terms, the software fails to restrict access to installation scripts and does not clean user input. This allows an attacker to trick the system into overwriting sensitive configuration files with malicious code that the server then executes.

When can an attacker trigger this vulnerability?

The flaw is triggered when an attacker sends specific, unsanitized data to the exposed installation and trigger files. It is important to note that this requires the software to have completed its initial setup process; the bug exists because these specific installation files remain accessible and unprotected even after the application is fully installed and in use.

Is my Wavelog instance at risk?

According to Halo Surface Signal, Wavelog is frequently deployed as a web service accessible over the internet to facilitate remote access. If your installation is reachable from the internet, it is at higher risk because attackers do not need to be on your local network or have login credentials to interact with the vulnerable components.

How should I respond to this vulnerability?

Start by identifying all Wavelog instances running in your environment. Prioritize those that are accessible over the internet or hold critical data. Your primary goal is to reach version 2.4.2, which contains the fix for these issues. If you cannot update immediately, investigate restricting network access to the affected installation directories.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.