Is CVE-2026-120198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120198 being exploited in the wild.

How severe is CVE-2026-120198?

Critical severity, with a CVSS score of 10, published 1 November 2026.

Which products and versions are affected?

Wavlink WL-WN530BE1-A M30BE1_V251117.

Is there a fix for CVE-2026-120198?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120198 attacked?

It is attacked over the network.

Am I affected by CVE-2026-120198?

Check whether you run Wavlink WL-WN530BE1-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120198: WAVLINK WL-WN530BE1-A command injection in protocol.csp

CVE-2026-120198 · Severity: critical · CVSS 10 · Published 2026-11-01

WAVLINK's WL-WN530BE1-A is a Wi-Fi router that manages network traffic and security. This vulnerability allows an attacker to execute arbitrary commands with root privileges on the device by sending a specially crafted request, bypassing all authentication protections. An attacker can read sensitive files like Wi-Fi credentials and VPN certificates, or fully compromise the device to intercept network traffic.

Technologies: Wavlink WL-WN530BE1-A. Vendors: Wavlink.

Quick answers

Is CVE-2026-120198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120198 being exploited in the wild.
How severe is CVE-2026-120198?: Critical severity, with a CVSS score of 10, published 1 November 2026.
Which products and versions are affected?: Wavlink WL-WN530BE1-A M30BE1_V251117.
Is there a fix for CVE-2026-120198?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120198 attacked?: It is attacked over the network.
Am I affected by CVE-2026-120198?: Check whether you run Wavlink WL-WN530BE1-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Unauthenticated command injection via the group_name parameter in /protocol.csp?opt=wireguard_cli_group, combined with IP-FROM HTTP header spoofing to bypass authentication (con_check_read_finish checks if IP-FROM equals 127.0.0.1 rather than the actual TCP peer address). The ioos binary concatenates unsanitized user input into a system() call without validation. An attacker on the network can forge the IP-FROM header and inject shell metacharacters in group_name to execute arbitrary commands as root.

Affected products

WAVLINK WL-WN530BE1-A M30BE1_V251117

Timeline

2026-11-01: disclosed: Exploit disclosed publicly on GitHub
2026-11-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.