On this page (7 sections)
A critical vulnerability, CVE-2026-120198, has been published for the WAVLINK WL-WN530BE1-A, firmware version V251117. According to the GitHub Advisory Database, the flaw allows command injection through a request argument, it can be attacked remotely, and an exploit has been disclosed publicly.
Anyone who runs this device, including small offices, agencies that deploy it for clients and administrators who manage branch networks, should treat it as urgent. The research does not list a patched version, so the practical focus today is limiting exposure.
What happened
The advisory describes a command injection weakness in the function con_check_read_finish, located in the file /protocol.csp. Manipulating the argument group_name/IP-FROM leads to command injection, and the attack can be launched remotely. The same text appears in the NVD record, which repeats the advisory and is not independent confirmation.
The advisory states that the exploit has been disclosed to the public and may be used, and that the vendor was contacted early about the disclosure. It does not say whether WAVLINK has responded, released new firmware or confirmed the issue. Only one publisher covers this so far, so details may change.
Technical details
Command injection (listed under CWE-74 and CWE-77) happens when software builds a system command from user-supplied input without properly neutralizing special characters, so the input is interpreted as part of the command rather than as plain data. The research does not say what privileges the injected commands would run with on this device.
The CVSS v4 metrics in the advisory describe the risk:
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Attack requirements | None |
| Privileges required | None |
| User interaction | None |
| Impact on vulnerable system (C/I/A) | High / High / High |
| Impact on subsequent systems (C/I/A) | High / High / High |
In plain terms: no login and no user action are listed as required, and the attack can come over the network. The advisory also rates the impact on subsequent systems as high. As a general reading of that CVSS metric (not a statement from the advisory), it means a successful attack could affect systems beyond the device itself. The advisory is marked Unreviewed on GitHub, so treat the exact score as provisional.
Who is affected
The only affected product named is the WAVLINK WL-WN530BE1-A at firmware V251117. The advisory does not say whether other firmware versions or other WAVLINK models share the code, so do not assume they are safe without checking with the vendor.
The advisory does not describe how the device is deployed. As a general rule, exposure is highest when a device's management interface can be reached from the internet or from untrusted network segments such as guest Wi-Fi, and lower when it is reachable only from a trusted internal network.
How to check your exposure
- Find the model and firmware version in the device's admin page or on its label, and compare it with WL-WN530BE1-A V251117.
- Check whether the web management interface is reachable from outside your network. Test from a connection that is not on your LAN, or review port forwarding and remote management settings on your upstream gateway.
- Review which networks and VLANs can reach the device's admin interface, including guest and IoT segments.
- Review any logs you already have (the device, your firewall or a reverse proxy) for requests to /protocol.csp from addresses you do not recognize.
The following command only applies if you happen to run a reverse proxy or web server that logs traffic to the device, which the research does not describe and which most setups will not have. It is a read-only search of an access log for requests to the affected path. Run it on the machine holding the logs and look for unfamiliar source addresses. The log path is only an example; adjust it to your system.
grep "/protocol.csp" /var/log/nginx/access.logWhat to do now
The research lists no patched version, so the steps below focus on reducing exposure. Check the WAVLINK support site for new firmware for this model and apply it as soon as one is confirmed for this issue.
0 of 8 done
Detection and monitoring
The research reports no scanning or exploitation activity for this flaw. Public exploits are often followed by automated scanning, so it is reasonable to be cautious with any internet-facing instance of this model, but that is a general precaution, not something reported here.
The signs below are generic indicators of a compromised network device, not signs tied specifically to this CVE: repeated requests to /protocol.csp from unfamiliar addresses (where you have logs), unexpected configuration changes, new admin accounts, DNS settings you did not set, and unexplained traffic spikes.
You can use the free Webforta security headers checker and SSL checker on any public web interface you run to see what it exposes, and Webforta Monitor to be alerted to certificate, DNS and uptime changes. These help with visibility only and do not detect or fix this specific flaw. For broader guidance on spotting compromise, see how to check if a website is hacked.
What is still unknown
- Whether WAVLINK has acknowledged the issue or published a fixed firmware version.
- Whether other firmware versions or WAVLINK models are affected.
- Whether the flaw is being exploited in the wild. The advisory only says the exploit is public and may be used.
- The full technical write-up. It is referenced from a third-party repository and from VulDB, which we have not independently verified.
Treat the details above as provisional until a vendor statement or a second independent source appears.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.