Executive Summary
A critical vulnerability has been discovered in WAVLINK WL-WN530BE1-A V251117, which allows for remote command injection. This vulnerability, tracked as CVE-2026-120198, has a CVSS score of 10 and is considered critical. The vulnerability affects the function con_check_read_finish of the file /protocol.csp, and it is possible to launch the attack remotely.
Technical Analysis
The vulnerability is classified as a command injection vulnerability. The attack vector is remote, and the vulnerability is triggered by manipulating the argument group_name/IP-FROM in the function con_check_read_finish of the file /protocol.csp. The root cause of the vulnerability is the lack of proper input validation.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the /protocol.csp file with a malicious group_name/IP-FROM argument. This would lead to command injection, allowing the attacker to execute arbitrary commands on the vulnerable device. The attacker can achieve remote code execution, potentially leading to a complete compromise of the device.
Impact Assessment
The WAVLINK WL-WN530BE1-A V251117 device is affected by this vulnerability. An attacker can achieve remote code execution, potentially leading to a complete compromise of the device. The CVSS score of 10 indicates a critical vulnerability with high impacts on confidentiality, integrity, and availability.
Recommended Actions
To mitigate this vulnerability, it is recommended to update the WAVLINK WL-WN530BE1-A device to a version that is not vulnerable. Additionally, network administrators should block any suspicious traffic to the /protocol.csp file and monitor for any unusual activity on the device. Implementing a web application firewall (WAF) rule to detect and prevent command injection attacks can also help.
Sources
- National Vulnerability Database (NVD)
- Vuldb.com