CVE-2026-109109CWE-119CWE-121

CVE-2026-109109

Critical · published October 13, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.00584 · 47.2th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2026-10-13T12:17Z
References (5)
https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1 · [email protected]https://vuldb.com/cve/CVE-2026-109109 · [email protected]https://vuldb.com/submit/909191 · [email protected]https://vuldb.com/vuln/416860 · [email protected]https://vuldb.com/vuln/416860/cti · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 13 OCT 07:45Z
    Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
    cvelistv5
  • 13 OCT 07:45Z
    Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
    cvelistv5