CVE-2026-109108: Wavlink Wl-WN530BE1-A

Critical severity, CVSS 9.9. EPSS: 2.3% chance of exploitation in the next 30 days.

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Affected products

• Wavlink Wl-WN530BE1-A: version 251117 only

Published 2026-10-13. Last modified 2026-10-16.