CVE-2026-110958: Wavlink WN530HG4B api.cgi heap-based overflow
A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wavlink WN530HG4Bto a version that resolves this vulnerability.Fixed in 2026-09-24-841a51c6d5_tclinux.bin
Event History
Frequently Asked Questions
Does exploiting this issue require authentication or user interaction?
No. The supplied severity vector indicates no privileges and no user interaction are required, and the attack can be launched remotely.
Which firmware update resolves the issue?
Upgrade the affected WN530HG4B device to firmware version 2026-09-24-841a51c6d5_tclinux.bin. The vendor states that the issue has already been addressed in current firmware.
What component should be prioritized for review if patching cannot happen immediately?
Prioritize exposure of api.cgi, particularly requests involving the api=info&client=app handler. The vendor says the corrected handler invokes the login script using execvp rather than system(), and applies length checks and null checks to the client address.