CVE-2026-109108: OS Command Injection in Wavlink WL-WN530BE1-A

This vulnerability in Wavlink WL-WN530BE1-A 251117 involves OS command injection via the popen function in /cgi-bin/uploadVpn.cgi. Manipulation of the 'Type' argument allows remote attackers to execute arbitrary operating system commands, potentially compromising the device. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. The exploit has been publicly disclosed, but no known active exploitation is reported. The vendor was contacted early, but no patch or remediation information is provided.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could enable attackers to control the device, disrupt services, or use it as a foothold for further network attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable endpoint and applying network-level controls to limit exposure may reduce risk.