A critical command-injection flaw in a WAVLINK networking device has been given the maximum severity score of 10.0, with exploit code publicly disclosed and no fixed firmware version listed in the vulnerability record at the time of publication. The flaw, tracked as CVE-2026-120198, was published on 1 November 2026 and affects the WAVLINK WL-WN530BE1-A running firmware version V251117.

How the flaw works

According to the CVE record summarised by threat-intelligence trackers, the vulnerability sits in the con_check_read_finish function of the /protocol.csp file. By manipulating the group_name/IP-FROM arguments, a remote attacker can inject operating-system commands and run them on the device. The CVSS 4.0 vector records the attack as network-accessible, low complexity and requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability.

Why it matters for home and small networks

Routers and access points sit at the edge of a network, so a flaw that allows remote command execution is especially serious: a compromised device can be used to intercept traffic, redirect users or provide a foothold into other equipment on the same network. The record states that public exploit code is available, which raises the urgency even though the tracker notes no attack traffic recorded by its own sensors. No vendor advisory or patched version was listed in the record when it was published, and the vendor was contacted early about the disclosure.

What owners should do now

Owners of the affected model should check their exact model and firmware version, look for any new WAVLINK firmware release, and restrict remote management access to the device until a fix is available. Where a device cannot be patched, network segmentation and, if necessary, replacement should be considered. This article describes the published vulnerability only; it does not reproduce exploit code or instructions for attacking a device.

Sources: OffSeq Threat Radar; CVEFeed.