CVE-2026-120198: WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

Published Nov 1, 2026

Updated

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function concheckreadfinish of the file /protocol.csp. Such manipulation of the argument groupname/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via MITRE·04:15 AM

Data Sourced

via MITRE·04:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

WAVLINK WL-WN530BE1-A devices running V251117 are affected. The vulnerable protocol.csp endpoint can be attacked remotely.

Does exploitation require authentication or user interaction?

No. The provided vector indicates network access, low attack complexity, no privileges required, and no user interaction.

What input is used to trigger the injection?

The issue is in con_check_read_finish in /protocol.csp, where manipulation of the group_name/IP-FROM argument can lead to command injection.

Is exploit code or public exploitation information available?

Yes. The exploit has been publicly disclosed and may be used.

CVE-2026-120198: WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Does exploitation require authentication or user interaction?

What input is used to trigger the injection?

Is exploit code or public exploitation information available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Does exploitation require authentication or user interaction?

What input is used to trigger the injection?

Is exploit code or public exploitation information available?