Description
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wavlink | WL-WN530BE1-A | M30BE1_V251117 | — |
References
- Researcher Advisory (F-yyjy): WAVLINK WN530BE1-A Unauthenticated Command Injection third-party-advisory exploit
- VulnCheck Advisory: Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler third-party-advisory