CVE-2026-113802

Summary

This vulnerability allows remote attackers to execute arbitrary commands as root on Wavlink routers by injecting OS commands through an unsanitized parameter in the firmware's web interface. The flaw stems from improper input validation in the ioos binary, making it a critical command injection vulnerability.

Exploitability

Exploitation is straightforward for remote unauthenticated attackers who can send forged IP-FROM headers to bypass authentication and execute commands with root privileges.

Blast radius

The vulnerability affects multiple Wavlink routers running firmware version M30BE1_V251117 or earlier, potentially allowing widespread remote code execution across affected devices in the field.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version M30BE1_V251118 or later to remediate this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.