Key points
- CVE-2026-110957 affects Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604.
- The flaw allows remote OS command injection through the api.cgi login process.
- Wavlink released a patched firmware version to resolve the critical vulnerability.
Wavlink WL-WN530BE2-A routers contain a critical flaw that lets attackers run system commands remotely. The vulnerability resides in the login processing component of the device firmware. Attackers can manipulate the REMOTE_ADDR argument to inject operating system commands. This exposure allows remote initiation of attacks against the device.
The issue stems from how the api.cgi file handles login requests. Specifically, the sub_12580 function processes client addresses insecurely. According to the National Vulnerability Database, this weakness maps to CWE-78 and CWE-77. The exploit has been disclosed publicly, meaning malicious actors can actively target affected devices.
What we know
Wavlink confirmed the finding and stated the issue is already addressed in new firmware. The vendor explained that the api=info&client=app handler no longer builds shell commands directly. Instead, the login script now uses an argument vector via execvp. This change replaces the previous system() call method.
The updated code also enforces strict length limits on client addresses. It performs null checks to prevent injection attempts. The vendor advises upgrading to version 2026-09-24-841a51c6d5_tclinux.bin to fix the problem. This update is sufficient to resolve the identified security risk.
Defender's checklist
- Verify if your Wavlink WL-WN530BE2-A runs firmware M30BE2_V250604 or earlier.
- Check for available firmware updates on the vendor's official support page.
- Install the patched firmware version 2026-09-24-841a51c6d5_tclinux.bin immediately.
- Monitor network logs for unusual outbound traffic from router IP addresses.
What analysts watch for
Teams usually examine router access logs for failed login attempts with malformed headers. They check whether the device executes unexpected shell commands during authentication. Analysts look for new processes spawned by the web interface service. They also inspect outbound connections for command-and-control callbacks. Reviewing firewall rules helps identify unauthorized data exfiltration. Checking for modified system binaries indicates persistent access. Monitoring DNS queries reveals hidden communication channels.
Background: Firmware updates
Firmware updates are low-level software packages that control hardware functions. They bridge the gap between physical components and the operating system. Applying these updates closes security holes in the hardware interface, preventing attackers from bypassing standard security controls through direct device manipulation.
Read the full guide: What Is Firmware Updates: The Hidden Layer That Protects Your Hardware
What to do and how to stay safe: Wavlink
- Check your router's firmware version against the affected list immediately.
- Download and install the latest firmware from Wavlink's official website.
- Change default administrative passwords to strong, unique credentials.
- Disable remote management features if they are not required for operation.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wavlink router models are affected by CVE-2026-110957?
The Wavlink WL-WN530BE2-A router running firmware up to version M30BE2_V250604 is affected.
Is there a patch available for this vulnerability?
Yes, Wavlink released firmware version 2026-09-24-841a51c6d5_tclinux.bin to fix the issue.
How does the vulnerability allow remote code execution?
It allows OS command injection by manipulating the REMOTE_ADDR argument in the login handler.
