CVE-2026-113802: Wavlink firmware flaw allows root RCE via login bypass

Wavlink WL-WN530BE1-A firmware up to M30BE1_V251117 contains an OS command injection in the ioos binary; a forged IP-FROM: 127.0.0.1 header bypasses login and runs commands as root. NVD rates it 9.8 under CVSS 3.1. ZoomEye found 3,502 hosts with the Wavlink fingerprint but zero matching the page title.

• CVE-2026-113802: command injection in ioos, CVSS 3.1 score 9.8, CVSS 4.0 score 9.3
• Forged IP-FROM: 127.0.0.1 header bypasses login and grants root
• ZoomEye: 3,502 hosts with Wavlink fingerprint, 2,992 of them on port 80
• Zero hosts match both app="Wavlink" and title="Wavlink"