EXPOSURES › CVE-2026-109109
CVE-2026-109109
CRITICALA stack-based buffer overflow in Wavlink WL-WN530BE1-A firmware allows remote code execution via the Settings Export CGI.
Wavlink WL-WN530BE1-A firmware contains a stack-based buffer overflow in the Settings Export CGI that can be triggered remotely via HTTP_COOKIE/X-Cmd, enabling arbitrary code execution. DIB organizations must ensure all network hardware is patched and monitored, as unpatched firmware in critical infrastructure can lead to full device compromise and data exfiltration. This failure is avoidable through regular firmware updates and vulnerability scanning.
Shame score — A critical CVSS 10.0 remote code execution vulnerability in network hardware was publicly exploitable, indicating a severe lapse in patch management and security hygiene.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.