CVE-2020-13117: Wavlink router login key parameter command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command execution with a 9.8 CVSS score and public exploit code, though not yet in KEV.

What it is

Wavlink WN575A4, WN579X3 and WN530G3A devices through 2020-05-15 pass the login request 'key' parameter to a command without sanitization, allowing command injection. Because the flaw is reachable before authentication, any network-touching attacker can run commands on the device. The record does not state which firmware builds are fixed, so affected version ranges beyond the 2020-05-15 cutoff are unknown.

Impact

An unauthenticated attacker gains arbitrary command execution on the device, giving full control of the router (confidentiality, integrity and availability all rated high). That position can be used to intercept or redirect traffic and to pivot into the internal network.

Attack surface

Reached over the network via the login request's key parameter; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. Any host that can reach the device's web interface can attempt it.

Exploitation

Not listed in CISA KEV, but EPSS is 0.68576 (99.3rd percentile) and two references are tagged Exploit, including a public write-up and a proof-of-concept repository, so working exploit code is publicly available.

What to do

• Apply the vendor firmware update for WN575A4, WN579X3 and WN530G3A; the record does not name a fixed version, so confirm with Wavlink.
• If no patch is available, remove the devices' management interface from untrusted networks and restrict access to a trusted management VLAN.
• Disable remote/WAN administration and UPnP exposure on these devices.
• Replace end-of-support units that will not receive firmware fixes.
• Monitor vendor advisories for updated fixed-version information.

Detection

• Inspect HTTP requests to the device login endpoint for shell metacharacters or command strings in the key parameter.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Review device logs for login requests with abnormal key values or repeated failed logins followed by command execution.
• Watch for configuration changes or new admin accounts on these devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.