CVE-2026-113802: Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
Published Oct 20, 2026
·Updated
Wavlink WL-WN530BE1-A firmware through M30BE1V251117 contains an OS command injection vulnerability in the sub23B54 function of the ioos binary, which passes the unsanitized fileid parameter of /protocol.csp?opt=ovpnfile requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
Affected Software
1 affected component
Wavlink WL-WN530BE1-A firmware<=M30BE1_V251117
Event History
Oct 20, 2026
CVE Published
via MITRE·05:59 PM
Data Sourced
via MITRE·05:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which devices should be considered affected?
Wavlink WL-WN530BE1-A devices running firmware through M30BE1_V251117 should be considered affected.
2
Does an attacker need valid credentials or local network access?
No valid credentials are required. A remote attacker can forge an IP-FROM: 127.0.0.1 header to bypass the login check.
3
What level of access can successful exploitation provide?
Successful exploitation can execute arbitrary operating-system commands as root.