Critical severity · published Oct 13, 2026
CVE-2026-109109
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-WN530BE1-A · Wavlink
251117 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109109
vdb-entry
https://vuldb.com/vuln/416860
signature
https://vuldb.com/vuln/416860/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-109109
third-party-advisory
https://vuldb.com/submit/909191
broken-link
https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1
More from WL-WN530BE1-A
9.9
CVE-2026-109108
Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
9.8
CVE-2026-113802
Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler