# CVE-2026-110957: Wavlink WL-WN530BE2-A os command injection in login processing

Source: https://junglewise.ai/threats/cve-2026-110957-a-vulnerability-has-been-found-in-wavlink-wl-wn530be2-a-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-110957 · Severity: critical · CVSS 10 · Published 2026-10-15

Wavlink's WL-WN530BE2-A is a WiFi 6E router used in home and small business networks. An unauthenticated attacker can remotely inject arbitrary operating system commands through the web interface, gaining complete control of the device. This can lead to data theft, device compromise, and use of the router as an attack platform.

Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-110957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110957 being exploited in the wild.

**How severe is CVE-2026-110957?** Critical severity, with a CVSS score of 10, published 15 October 2026.

**Which products and versions are affected?** Wavlink WL-WN530BE2-A up to M30BE2_V250604.

**Is there a fix for CVE-2026-110957?** Yes: fixed in 2026-09-24-841a51c6d5_tclinux.bin. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110957 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-110957?** Check whether you run Wavlink WL-WN530BE2-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026-09-24-841a51c6d5_tclinux.bin

## Technical details

The api.cgi binary's login processing function (sub_12580) constructs a shell command using sprintf() and system() without sanitizing the REMOTE_ADDR environment variable, allowing command injection. An attacker can reach the vulnerable code path via GET /cgi-bin/api.cgi?api=info&client=app without authentication. The vulnerability allows arbitrary OS command execution with web server privileges.

## Affected products

- Wavlink WL-WN530BE2-A up to M30BE2_V250604

## Timeline

- 2026-10-15: disclosed
- 2026-10-15: advisory

## References

- [https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin](https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin)
- [https://github.com/F-yyjy/cve/blob/main/WN530BE2-A_api-cgi.md](https://github.com/F-yyjy/cve/blob/main/WN530BE2-A_api-cgi.md)