CVE-2026-110957 is an OS command injection (CWE-78, CWE-77) in the login handler of the Wavlink WL-WN530BE2-A router, scored 10.0 critical. It affects firmware up to M30BE2_V250604. Upgrade to firmware 2026-09-24-841a51c6d5_tclinux.bin, which the record says fixes the issue, and close remote admin access.
What's affected
Wavlink WL-WN530BE2-A with firmware up to M30BE2_V250604, per the CVE record. The fixed build named in the record is WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin, available from the vendor firmware download site.
The record places the flaw in the function sub_12580 of api.cgi, in the login processing component, through the REMOTE_ADDR value. The vendor quote in the record says the handler no longer builds a shell command. The login script now runs through an argument vector with execvp instead of system(), and the client address is length limited and checked for null.
The record says a public disclosure exists, but it does not say the flaw is exploited in the wild, and it is not a CISA Known Exploited Vulnerability. The score of 10.0 reflects that a network attacker needs no account.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or system information page. Compare it with M30BE2_V250604 and the 2026-09-24 build named above. If the version is older than the fixed build, treat the router as exposed.
Then check how the management interface is reachable. Look at whether the web admin or remote management is open to the internet, and whether guests or other untrusted devices on the local network can reach it. Check the router for unexpected settings, such as changed DNS servers, unknown port forwards or new admin accounts.
For a fleet, keep a list of router models and firmware versions in your asset inventory. Network gear is often missing from software scans, so add it by hand.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Download the fixed firmware from the vendor site and verify that it matches the model and the build named in the record before flashing.
- Take a backup of the router configuration, flash the new firmware, then reload the config and recheck the settings.
- Turn off remote management from the internet, and limit the admin page to a trusted management network.
- Check for changed DNS settings, unknown port forwards or new accounts, and change the admin password after the upgrade.
- If the router cannot be updated, put it behind another firewall or replace it.
Why it matters
The login handler built a shell command from a client address, and the record says an attacker controls that value. That is CWE-78, with CWE-77 noted as a related class for command construction. The fix replaces the shell with a direct program call and checks the input length. Both changes are the standard answer to this bug.
Routers are a hard patch target. They sit at the edge, run unattended, and often keep old firmware for years. A flaw that needs no login makes the exposure of the admin page the key question, so closing remote management is the quickest mitigation while you schedule an upgrade.
Treat any device that was reachable and unpatched as possibly compromised, and look at its settings, not only its version.
Quick check
Is the router safe after the firmware update?
The vendor says the handler no longer builds a shell command. Also check settings and credentials, because an attacker who got in earlier could have left changes behind.
What if I cannot flash right now?
Turn off remote management, restrict the admin page to a trusted network and schedule the upgrade soon.
Sources
Last reviewed: 19 October 2026.
