Read the docs
TI-2026-39140 Aliases CVE-2026-54237

Wavelog: Unauthenticated Remote Code Execution

Priority MEDIUM 49CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862 and CWE-94.

Summary

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00763 55th percentileScored 2026-11-07
Fix Fixed wavelog (wavelog): 2.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wavelogwavelog1.8 to before 2.4.22.4.2Patch availableCNA
  • wavelog Vendorwavelog Affected 1.8 to before 2.4.2 Fixed in 2.4.2 Patch available CNA

Remediation

  • Fix · CNA wavelog (wavelog) Fixed in 2.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54237

References

Other 4

  • TI-2024-32335 Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin. CVSS 3.1CRITICAL 9.8
  • TI-2024-32331 Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. CVSS 3.1HIGH 7.3
  • TI-2024-07899 Wavelog Live QSO qso index cross site scripting CVSS 4.0MEDIUM 6.9
  • TI-2024-32332 Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences