CVE-2026-109108: Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
Published Oct 13, 2026
·Updated
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Affected Software
1 affected component
Wavlink WL-WN530BE1-A=251117
Event History
Oct 13, 2026
CVE Published
via MITRE·07:30 AM
Data Sourced
via MITRE·07:30 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
The CVSS vector indicates that an attacker needs low-level privileges but does not need user interaction. The attack can be performed remotely over the network.
2
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
3
Are versions other than 251117 known to be affected?
The available data identifies WL-WN530BE1-A version 251117. It does not establish whether earlier or later versions are affected.