CVE-2026-113802: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Wavlink WL-WN530BE1-A

The vulnerability in Wavlink WL-WN530BE1-A firmware (up to M30BE1_V251117) involves improper neutralization of special elements in OS commands (OS command injection). Specifically, the ioos binary's sub_23B54 function uses the file_id parameter from /protocol.csp?opt=ovpn_file?type=del requests without sanitization, passing it directly to popen(). This allows a remote unauthenticated attacker to bypass authentication by forging an IP-FROM: 127.0.0.1 header and execute arbitrary commands with root privileges.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary OS commands as root on the affected device, leading to full system compromise. This can result in unauthorized control, data theft, device manipulation, or disruption of service. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device to trusted sources only and monitor for suspicious activity related to /protocol.csp requests. Avoid exposing the device to untrusted networks.