EXPOSURES › CVE-2026-109108
CVE-2026-109108
CRITICALWavlink WL-WN530BE1-A firmware allows remote command injection via the uploadVpn.cgi script.
An unpatched command injection flaw in Wavlink's WL-WN530BE1-A firmware lets attackers execute arbitrary OS commands remotely via the uploadVpn.cgi script. DIB organizations must verify that all Wavlink hardware is patched or replaced, as this flaw enables lateral movement and data exfiltration. The vendor was contacted early, but the exploit is already public and in use.
Shame score — A critical remote command injection flaw in network hardware was publicly exploited before a patch was widely deployed, indicating negligent patch management and avoidable exposure.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.