# CVE-2026-120198: WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

- Exploited (CISA KEV): no
- Published: 2026-11-01
- CVSS: 10 CRITICAL (v4.0)
- EPSS: 2.1% (81th percentile)
- CWE: CWE-77, CWE-74

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

2 posts seen since 2026-11-02.

- x 2026-11-02: 💥 New CVE with a public exploit: CVE-2026-120198 (CVSS 10.0) WAVLINK WL-WN530BE1-A · Remote code execution Remote, no login needed.  A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117.  https://t.co/aidgiQjGF3 (https://x.com/EnclaveRadar/status/2117392775880523964)
- bluesky 2026-11-02: New critical vulnerability in WAVLINK WL-WN530BE1-A: CVE-2026-120198, CVSS 9.3. A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. No public exploit reported yet. EPSS 2.1%. #CVE #vulnerability  threatroundup.com/cve/cve-2026... (https://bsky.app/profile/threatroundup.bsky.social/post/3mze3dcszpq2d)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-120198 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-120198