CVE-2026-120198
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117
- Risk score
- 81/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 2.1%
- Published
- 1 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A command injection vulnerability has been found in the WAVLINK WL-WN530BE1-A V251117 device, allowing an attacker to launch a remote attack. The vulnerability is due to manipulation of the argument group_name/IP-FROM in the /protocol.csp file.
- Affected
- {'product': 'WAVLINK WL-WN530BE1-A V251117', 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for a fix, as none is specified in the record.
- Exploitation
- Public proof of concept
Why it is Red
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Last activity 1 Nov 2026. Patch Forecast updates every hour.