CVE-2026-109109: Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can initiate the attack remotely by manipulating the HTTP_COOKIE/X-Cmd argument sent to the Settings Export CGI endpoint. No authentication or user interaction is indicated by the supplied severity vector.
Are systems running the identified firmware version affected?
The affected product and version identified in the available data are Wavlink WL-WN530BE1-A 251117. The vulnerable endpoint is /cgi-bin/ExportAllSettings.cgi.
How urgent is mitigation?
This is rated critical with network reachability, low attack complexity, and high impacts to confidentiality, integrity, and availability. Public exploit availability is also reported, so exposed devices should be prioritized.
Is a vendor fix or workaround available?
The provided data states that the vendor was contacted early about the disclosure, but it does not provide a patch, fixed version, or workaround.