An authenticated remote code execution vulnerability in WAVLINK WN530H4 routers poses a severe risk of total device compromise and unauthorized network access.

This is an OS command injection vulnerability (CWE-78) occurring in the set_add_routing function of the /cgi-bin/internet.cgi endpoint. The vulnerability requires the attacker to be authenticated to the device management interface, where they can inject shell metacharacters into POST parameters to execute commands with root privileges.

Successful exploitation allows an attacker to gain full control over the affected router, which serves as a critical gateway for network traffic. This compromise enables the installation of persistent backdoors, interception of sensitive network communications, and potential lateral movement into the internal network, creating significant security and operational risks for the organization. The CVSS score of 7.2 reflects the high impact on confidentiality, integrity, and availability, despite the requirement for administrative authentication.

Immediate Action: Update the device firmware to version 2026.04.16 or newer, which is available from the official WAVLINK support portal.

Proactive Monitoring: Review web management access logs for anomalous POST requests to /cgi-bin/internet.cgi, specifically monitoring for unusual shell metacharacters like semicolons or pipe symbols in routing configuration parameters.

Compensating Controls: Restrict access to the router management interface to a dedicated management VLAN or trusted IP addresses using firewall rules to prevent unauthorized users from reaching the vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical submission report found at the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the critical nature of command injection in network infrastructure, administrators must prioritize this update. Ensure all WN530H4 routers are patched to the latest firmware version immediately to prevent potential remote code execution and unauthorized access to the network perimeter.