CVE-2026-109108

Summary

A command injection vulnerability exists in Wavlink router firmware where user-supplied input to the 'Type' parameter in /cgi-bin/uploadVpn.cgi can be manipulated to execute arbitrary OS commands with high privileges. This allows attackers to gain full system control of the device.

Exploitability

Exploitation is straightforward and requires no special preconditions, as the vulnerability allows remote command injection through a web interface without authentication.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise any affected Wavlink router, potentially enabling them to redirect traffic, install malware, or use the device as a pivot point for further network attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.530 or later, which contains the patched version of /cgi-bin/uploadVpn.cgi that resolves the command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.