Overview
CVE-2026-120198 is a critical command injection in the WAVLINK WL-WN530BE1-A, firmware V251117. The con_check_read_finish function of /protocol.csp mishandles the group_name / IP-FROM arguments, allowing commands to be injected. NVD states the attack can be launched remotely and that the exploit has been disclosed publicly and may be used.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-120198 |
| Severity | Critical |
| CVSS Score | 10.0 |
| Weakness | Command injection |
| Affected component | /protocol.csp — con_check_read_finish |
| Vulnerable parameters | group_name, IP-FROM |
| Attack vector | Remote |
| Exploit status | Publicly disclosed |
| Published | 2026-11-01 |
Impact
A CVSS 10.0 score with a public exploit makes exposed devices attractive targets for mass scanning. Successful exploitation can give an attacker command execution on the router, enabling traffic interception, DNS manipulation, lateral movement, and botnet enrollment.
Related WAVLINK flaws: CVE-2026-120197, CVE-2026-120196, and CVE-2026-120195.
Remediation
- Check WAVLINK for fixed firmware for the WL-WN530BE1-A and apply it when available.
- Disable remote management and keep the web interface off the internet.
- Restrict access to the admin interface to trusted LAN hosts only.
- Replace the device if no fix is released.