Critical 10.0Published Oct 13, 2026

CVE-2026-109109Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects Wavlink WL-WN530BE1-A. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.58%, higher than 47% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Wavlink WL-WN530BE1-A

Exploited in the last 30 days

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS: 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
Weakness (CWE): CWE-121, CWE-119
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.58% (percentile 47)
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

Wavlink WL-WN530BE1-A wavlink:wl-wn530be1-a	251117	CNA record

References

https://vuldb.com/vuln/416860vdb-entry, technical-description
https://vuldb.com/vuln/416860/ctisignature, permissions-required
https://vuldb.com/cve/CVE-2026-109109third-party-advisory
https://vuldb.com/submit/909191third-party-advisory
https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1broken-link, exploit

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.