CVE-2026-120198 · WAVLINK WL-WN530BE1-A /protocol.csp command injection via…

01 · The Real Story

A web tweak becomes a root shell on a home router

CVE-2026-120198 is a command injection in the con_check_read_finish function of /protocol.csp on WAVLINK WL-WN530BE1-A firmware V251117. An attacker who can reach the web management interface can supply a malicious group_name or IP-FROM parameter that is concatenated into a shell command, leading to unauthenticated root command execution on the device. The vendor advisory does not list a patched firmware version at disclosure.

The vendor's CRITICAL/10.0 CVSS assumes the management plane is reachable by a remote unauthenticated attacker and assigns a scope-changed impact. In most default deployments the admin interface listens on the LAN only, so the internet-facing attack surface is limited to remote-management users. For an enterprise patching org the bigger issue is whether home/telework users have this device; it is not a typical data-center or branch router.

"A remote command-injection hole in a consumer Wi-Fi router that most enterprise patch queues can back-burner unless you run WAVLINK edge units."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Identify a reachable WAVLINK WL-WN530BE1-A management interface

Attacker scans for the device's web UI using Shodan/Censys or targets a known IP. The endpoint /protocol.csp is part of the management application; if remote management is enabled or the attacker is on the LAN/WLAN, the endpoint is reachable. On default firmware, HTTP/HTTPS admin is usually LAN-only.

Conditions required:

Attacker can send HTTP requests to the router's management port (typically 80/443)
Remote web management is enabled OR attacker already has local network access

Where this breaks in practice:

WAVLINK devices are not commonly internet-exposed in enterprise inventories
Default settings often restrict admin access to LAN clients
The specific model WL-WN530BE1-A is not widely deployed in managed fleets

Detection/coverage: Shodan/Censys can identify exposed WAVLINK/Tenda-like admin panels; internal vuln scanners may not fingerprint this SOHO device.

STEP 02

Craft a command injection in group_name or IP-FROM

Attacker sends a POST/GET to /protocol.csp with a shell metacharacter payload in group_name or IP-FROM. The con_check_read_finish handler passes the argument to a system call without sanitization. The exploit is public and may be adapted into botnet tooling.

Conditions required:

Attacker can reach the endpoint
Parameter is accepted by the firmware's request parser

Where this breaks in practice:

May require knowing the exact request structure; public exploit lowers this barrier
Some WAFs/proxies in front of the device could block shell metacharacters, but home routers rarely sit behind a WAF

Detection/coverage: Generic web attack signatures for command injection may catch obvious payloads if the device is behind an IDS/IPS; no vendor-specific check exists.

STEP 03

Execute commands as root on router OS

The injected command runs with the privileges of the web service, which on WAVLINK firmware is typically root. This gives the attacker full control of routing, DNS, firewall, and radio settings. Persistence can be achieved by writing to firmware/config or adding cron entries.

Conditions required:

Successful command injection
No OS-level sandbox on the router (common for SOHO firmware)

Where this breaks in practice:

If the device is a home router, impact is limited to that user; if it is a branch router, an attacker needs to pivot further
Firmware may reset after reboot unless attacker persists

Detection/coverage: Network monitoring may see outbound connections from the router to C2, but home routers usually lack endpoint telemetry.

STEP 04

Abuse router position to pivot or capture traffic

From the router, an attacker can redirect DNS, perform man-in-the-middle on unencrypted protocols, or use the device as a relay into the LAN. In a home/telework scenario, this can target the enterprise laptop connected behind it; in a small branch, it can expose internal hosts.

Conditions required:

Router has connected clients or LAN segment with valuable assets
Attacker can maintain command execution

Where this breaks in practice:

Most enterprise VPN clients still encrypt user traffic, limiting credential capture
Home users often lack domain-joined assets, so lateral movement is constrained
Branch deployments of this specific WAVLINK model are rare in enterprises

Detection/coverage: EDR on enterprise endpoints may flag malicious DNS or network anomalies if the laptop is monitored; router itself has no detection.

03 · Compensating Control

MEDIUM 5.5→LOW 3.5

SEVERITY REDUCED

Disable remote management and restrict admin access to LAN-only — For any WAVLINK WL-WN530BE1-A you manage or can influence, turn off remote web management and apply an ACL/firewall rule permitting admin access only from trusted management VLANs. MEDIUM has no formal noisgate mitigation SLA, so treat this as a discretionary hardening step; apply within 30 days.

MEDIUM 5.5→LOW 4.0

SEVERITY REDUCED

Segment WAVLINK routers onto an isolated guest network or VLAN — If these devices must be used, isolate them from production segments and domain controllers to limit post-exploit lateral movement. This reduces the blast radius from local network compromise to a contained guest network. Apply during your next network hygiene cycle.

MEDIUM 5.5→MEDIUM 5.0

Monitor DNS and traffic from these devices — Deploy network-level detection for suspicious outbound connections or DNS changes originating from WAVLINK management interfaces. Detection won't prevent exploitation but can shorten dwell time. Use existing SIEM/NDR sensors if these devices are on managed segments.

MEDIUM 5.5→LOW 3.0

SEVERITY REDUCED

Track WAVLINK advisory and replace unsupported devices — Since no patched firmware is confirmed at disclosure, monitor vendor support channels and replace devices that do not receive a fix. For MEDIUM, noisgate remediation SLA is ≤365 days; plan replacement or firmware deployment within that window.

What doesn't work

EDR on connected endpoints won't prevent the router compromise; it only helps detect some post-exploit pivoting.
WAF/web filtering in front of the device is rarely present for home or SOHO deployments and may not parse router-specific parameters.
Vendor severity alone doesn't make this a fleet-patching priority; most enterprises don't run this model.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No CISA KEV listing and no confirmed active campaign; public exploit availability makes opportunistic IoT botnet use plausible.
PoC availability	Public exploit disclosed per vendor; check pocindex.io and GitHub for CVE-2026-120198 repos. No named researcher repo verified in this assessment.
EPSS score / percentile	Not yet scored or EPSS unavailable at disclosure date; treat as unknown rather than low.
KEV status	Not listed in CISA KEV as of 2026-05-07.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — network, low complexity, no privileges, no user interaction, scope changed; all impacts high.
Affected version	WAVLINK WL-WN530BE1-A V251117
Fixed version	None published at disclosure; vendor contacted early, patch not confirmed.
Scanning/exposure data	Use Shodan/Censys queries for `WAVLINK WL-WN530BE1-A` or `/protocol.csp`; no quantitative exposure number included in the official record.
Disclosure date	2026-11-01 (official record)
Reporting researcher	Unknown from the official record; vendor was contacted early by the discloser.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to MEDIUM (5.5/10)

Why this verdict

Default exposure shrinks the attack surface: most WAVLINK admin interfaces are LAN-only, so the internet-reachable population is only users who enabled remote management. From a 10.0 baseline that is a -1.5 adjustment.
Not an enterprise fleet device: WAVLINK WL-WN530BE1-A is a consumer/SOHO Wi-Fi router. Enterprise inventories rarely include this model, so the patch workload is not on 10,000 managed hosts. Additional -2.0.
No active campaign or KEV listing: exploit code is public but no tracked mass exploitation, so urgency is lower than many CVEs. -0.5.
Role multiplier: a compromised WAVLINK edge in a small branch could redirect traffic and pivot into a flat LAN, but less than 1% of the installed base sits in that enterprise edge role; it does not trigger the high-value-role floor for this assessment. The plausible worst-case is local network compromise, not domain/fleet-scale.

Why not higher?

It isn't HIGH or CRITICAL for enterprise patching because the device is not a standard enterprise asset, default WAN exposure is limited, and the high-value role floor is not met. If remote workers use this specific router in large numbers or if Shodan shows huge exposure, the score would move up.

Why not lower?

We don't go to LOW because a public unauthenticated RCE in a network device is still dangerous for any exposed unit, and it can be used as a foothold into a teleworker's network or small-branch LAN. A compromised router can silently redirect DNS or traffic, so even unsophisticated attacks can cause real damage.

06 · Verification

Crowdsourced verification payload.

Run this from an auditor workstation with network access to the router's management interface. Example: ./check_cve-2026-120198.sh 192.168.10.1. Requires curl and no root privileges.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
# CVE-2026-120198 check for WAVLINK WL-WN530BE1-A V251117
# Run from an auditor workstation with network access to the device admin interface.
# Requires curl; no root privileges.
TARGET="$1"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <router-ip>"
  exit 2
fi

FW=$(curl -sk --max-time 5 "http://$TARGET/" | grep -oiE 'WL-WN530BE1-A|V251117' | head -1)
if [ -z "$FW" ]; then
  FW=$(curl -sk --max-time 5 "https://$TARGET/" | grep -oiE 'WL-WN530BE1-A|V251117' | head -1)
fi

if [ -z "$FW" ]; then
  echo "UNKNOWN: cannot identify WAVLINK WL-WN530BE1-A on $TARGET"
  exit 1
fi

HTTP_CODE=$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -X POST "http://$TARGET/protocol.csp" -d 'group_name=check&IP-FROM=127.0.0.1')
if [ "$HTTP_CODE" == "000" ]; then
  HTTP_CODE=$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -X POST "https://$TARGET/protocol.csp" -d 'group_name=check&IP-FROM=127.0.0.1')
fi

if echo "$FW" | grep -qi 'V251117' && [ "$HTTP_CODE" != "404" ] && [ "$HTTP_CODE" != "000" ]; then
  echo "VULNERABLE: WL-WN530BE1-A V251117 with /protocol.csp reachable on $TARGET"
  exit 0
elif echo "$FW" | grep -qi 'WL-WN530BE1-A'; then
  echo "PATCHED/UNKNOWN: WL-WN530BE1-A found but not confirmed V251117 or /protocol.csp inaccessible"
  exit 1
else
  echo "UNKNOWN: $TARGET did not match expected WAVLINK firmware signatures"
  exit 1
fi